On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do not manage such redirection, another company is tasked to manage the network. Every seat has a laptop running W7 with no restriction at all, that's it, admin user by default. External people can't access the building, we have ID and fingerprint scanners.
I'm trying to "create" a security specific role. I'm new in this company but I'm the only one interested in security here.
So far I've analyzed passwords (every basic password principle is violated lol!), accounts management on servers (disable LDAP accounts when someone leaves, set expirity of temp accounts), privacy issues (webcam, logged sessions when leaving), clean desk policy (although as external people can't access, I'm not sure whether this is going to have any effect) and least privilege (limit access to some resources, admin and user accounts on laptops, prohibit the use of USB sticks).
According to all the stated above, what other security controls could I implement?