Finish off the security incident response policy, and create any missing IR plan, playbooks, and reporting. Also consider establishing a security incident severity scale to help guide response, and keep that scale aligned with Ops as much as possible.