At PKC  we’ve been in all these situations before  and we’re a big fan of starting security programs with the SANS Top 20 Controls list Done well  these 20 controls represent a complete security program