Security Simplification

If you were told by a VP to simplify security for your organization, what you think would be a starting point? It's seems vague. We run Windows servers/desktops that are built on the same images. We use Cisco switches/routers/etc. I'm not really sure where to start.