A risk assessment need to be executed to detect vulnerabilities and threats, usage policies for important technologies has to be developed and all staff security duties need to be described The RSI security website breaks down the measures in some detail, but the process in essence goes similar to this: https://www.chicagoheadlines.us/nathan-labs-expands-cyber-security-services-in-saudi-arabia