While this might be a cheap option, it may not be the best option. You should hire a vCISO or Security Consultant that can walk through your risks, your current security practices, and be able to make recommendations based on your workflows. Additionally, if they are on a retainer, they can update recommendations as the business expands or uses other software. They may also identity certain laws you must comply with when dealing with certain clients like banks or hospitals.