Hire a qualified CISO.