3 steps for better cybersecurity (2/2): What follows the initial discussion

The previous article explained how, if you want to take cybersecurity seriously, the first step is a thorough initial discussion. After that, what comes next?