If you can get a budget for a security consultant/auditor to help put the policies and frameworks together, including conducting a baseline audit and identifyin

If you can get a budget for a security consultant/auditor to help put the policies and frameworks together, including conducting a baseline audit and identifying gaps, that would be a start. While IT aspects are a big part of the security (patches, vuln assessments, access control, environment separation etc.,) there are quite a few policy, documentation, review and controls and people aspects etc., that are important in any infosec framework.