Compliance frameworks are a floor, and a useful one. They give a lean team a defensible checklist and a budget argument. What they do not give is a sense of proportion, because every control in the list carries equal weight on paper.
Resilient organizations re-rank that list against their own dependency map. The control that protects the system the business cannot run without gets funded first, whatever order the framework lists it in.
The last step is rehearsal. Incident response written and never practiced fails in the same predictable places: unclear authority, missing contact details and no agreed definition of who declares an incident.