You cannot protect everything to the same level. We start by identifying the most important data and systems, then design protection by risk: access, encryption, backup and monitoring.
And no data classification.
People reach data they do not need.
That need an ordered fix plan.
Assets and data by sensitivity.
Identity, encryption and backup.
What is monitored and who acts on an incident.
Easy to update.
In priority order.
With roles.
With system owners.
Against recognised practice.
What is done first.
With the IT team.