If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?
Typically, one has an approach that involves isolating breaches, identifying them, restoring service with the immediate attack vectors closed, and shoring up after that.
Sony's issue appears to be systemic. Their systems are varied, complicated, and numerous. As I understand it, weaknesses are everywhere. They cannot return to functioning because even they are not compromised in an isolated way.
In this way, Sony is a bad example for your idea. In another way, Sony is a fantastic boon to us. Need an example of poor security destroying something that didn't go out of business right away and wasn't too small to ignore? This is it.
Isolate and identify is now... forensics on the machines, work with law enforcement immediately because this is a "big fish" issue. Restoring service is just about out. Everything needs to be looked at from a basic level on up with security in mind. Sony in its present state may not even be able to identify where valuable data is located at.
You don't get here, because here is the bad place to be. Too big to react, too long without considering security implications. Nothing can be trusted, and fixing everything will be very expensive.
Since Sony is a Japanese company, I would imagine the management structure of the subsidiaries is very hands off. That is very typical of Japanese owned and managed organizations. A big piece of this is likely due to the autonomy given to individual organizations to "do their own security."
Due to this, I would establish a global governing body and get Sony to require presence in each organization to act in the internal audit and reporting capacity that reports to Sony Legal in Japan on a weekly basis.