An organization suffers a major data leak only six months after upgrading its security system. What should the organization do to ensure long-term security?