Undertaking an access audit and writing a action plan.