I would also add to this do not be a box ticker. Yes we need policies and certifications but a piece will not make you secure. You need a culture of security, t

I would also add to this do not be a box ticker. Yes we need policies and certifications but a piece will not make you secure. You need a culture of security, that means both paper AND technical. Also, remember that you can achieve the best outcome when you adapt best practices to the specific context. Just because every other place you've been at does it a given way doesn't mean that is the right solution for your new company. Yes, solutions have to work and meet the requirements, but no they don't need to use the same products or techniques you're used to. The more you can adapt security to the way people work the more effective it will be.