It's hard to give specific advice without knowing what your cybersecurity experience is. But I'd make sure the boss knows going into the audit the company is g

It's hard to give specific advice without knowing what your cybersecurity experience is. But I'd make sure the boss knows going into the audit the company is going to have its ass handed to them. But that's actually a good thing. Having a good pentest/audit will give you an idea of where to start. If you can get funding, get Nessus and Burp Suite Pro. Burp Suite is best used if you have a good understanding of web app pentesting and can manually do stuff, but the automated scans are pretty decent too. Automated scans will pick up stuff that's usually easy to remediate and will thwart low-effort threats and/or script kiddies. If you can't get money for Nessus, OpenVAS can work. But if it were me and I couldn't get money for a Burp license, I'd pay for it out of my pocket. Also take time to understand what the upcoming audit is going to look for. If you understand the controls, you can go look how to implement those controls. And once the audit comes back, the audit should help you prioritize remediation. Someone suggested a SOC2 audit. Depending on how this audit goes, I think that's a good idea. Or at least try to adhere to the controls within SOC2, if you're not going to get the audit itself. ITProTv has some good security stuff. I'd review it if you have the time and/or inclination. It's a little basic, but solid basics are necessary.