Choose a light baseline, publish a short policy pack, create a simple use case register, and add minimum monitoring. Keep it to what your team will use every week. Expand only when risk grows.