Security leaders can use compliance auditing and penetration testing to help keep an organization ready in the event of a cyberattack.