Many organizations find it helpful to begin with a risk assessment or by developing an incident response plan, often with help from a law firm. A risk assessment shows what controls you should put in place under "protect." Consulting a law firm can give you a clearer picture of your overall cyber risks and the first steps to address them. Contact us if you’d like guidance—we’re happy to point you in the right direction.