Security is separated from compliance, is required ,What is our proactive plan to match countermeasures to our real cybersecurity threats in future?

Since cybersecurity attacks are evolving so fast, waiting for being attacked is not enough. Building a Security Operation Center is a must, but there also must be a dedicated team doing cyber intelligence duties. By doing extensive researches on the web/darknet/social networks, it's effectively possible to understand which threats other organizations are fighting (e.g. new targeted campaigns of spam emails trying to deliver Cryptolocker or other sophisticated malwares) and to start improving defenses in a proactive way.

Greater visibility is absolutely required—everywhere. Make sure your company is positioned to see more data and is capable of turning it into actionable information. While risk from threats continues to increase and potential economic fallout is real, the good news is we have made dramatic improvements in technology’s ability to capture massive amounts of data, conduct targeted analysis to detect problems, and prioritize rapid response to address key risks.