+1, Asset and Inventory managment . It is surprising how late in your organizations security journey you realize that it should have been one of your early investments into security controls
Policies and procedures maybe not be the most under valued security control, but could very well be the least invested in security control