You need an established Framework: ISO 27001 or NIST. Understand the repercussions of not having a framework and how you can get started.