I would implement access control and train staff based on their role. I would also implement management and maintenance to ensure the resilience of the systems and make sure there are no threats.