Do you have documented information security policies and procedures?

Doing so will help you define goals for the organization in regards to information security, as well as provide an outline for how your organization will meet these goals.