Every institution should know this answer by now. Note that a full inventory will include software systems, hardware, networking devices, and operating systems. Some buildings have systems or facilities within that cause them to be high risk, and sometimes the question is more simply related to building security or other infrastructure. A simple punch list of base infrastructure tests should suffice for most buildings. Remember that the question applies to embedded chips as well.
Triage is a critical second step.
Few, if any will fix every problem. Technical solutions are important, but in comparison to management processes, technical solutions may prove to be the less difficult part of the problem. The question here is whether ALL management agrees on the critical list, not just technical personnel. Perhaps you should ask for examples to get a sense of current thinking. Given the time remaining, and the critical nature of this activity, a system of checks and balances might not be out of the question.