Hire an IT consultant who is familiar with compliance. They will provide your company with a compliance risk assessment that details everything you need to remedy in order to achieve compliance.