Hiring a cyber-security expert is not a step to take to protect an organization's sensitive data