Get commitment from all leaders and key decision makers within the organization.
2. Create a formalized program identifying vital standards and regulations, conceptualizing policies, and creating controls.
3. Identify the critical systems, assets, processes, and vendors that compliance must be managed against.
4. Identify those who should be responsible for the compliance of the critical systems, assets, processes, and vendors.
5. Create a centralized repository to identify non-compliance, for data, audit logs, asset information (like the CMDB).
6. Where needed, deploy external parties to assist with specialized knowledge.
7. Offer and mandate compliance training throughout all relevant departments.