Security
Something you want, rarely reserve time for

That is why a consultant is the best answer to remind you of the tedious password policies and background checks that should be performed regularly.

Hardware controls should be made on a weekly basis, same as patch control on a specified policy basis.

Risk and Risk Management of your infrastructure is crucial before all your hard drives are encrypted by an intruder.