The simple things in inosec are often the most effective

data classification - classify the say 10% of information assets that really matter and you can:

secure only the systems that really manner.

enable users to apply information asset handling procedures to prevent data leakage