Establish your risk management
Who owns the risk?
Depending on the situation the risk can be shared among organizations to off-load the risk. It can also be entirely transferred to a 3rd party.
Minimum baseline controls implementation
Controls will be selected across all forms of the organization and appropriately implemented to ensure they are met.