1. What's at stake
  2. Define scope
  3. Adhere to a security standard
  4. Defining the policies
  5. Conducting a gap analysis
  6. Interpreting the analysis results
  7. Prioritizing remediation
  8. Getting to a comfortable level
  9. Conducting a penetration test
  10. Passive security monitoring
  11. Active security monitoring
  12. Threat hunting
  13. Continuous battle
  14. Time to reflect