Establishing cybersecurity practices in an enterprise