One of the things I try to do is to think about where I want my department to be next year. I always like to build up my threat hunting capabilities. To do this you will need some security analysts. The ideal situation is to have both Senior and Junior analysts so that you have 1) a career path Jr>Sr>ISSO/CISO and you have built in training potential. Sr teaches Jr how to do it better.
Sounds like you are off to a good start. One of the biggest challenges you will face around policy is going from Federal government to this agency. You didn't mention if it was state or local government but usually a service like water/wastewater is done at a local or state level. Could be some federal ones too, but I am guessing more local/state. I had over 25 years in federal government. The big advantage of the feds is ready made documentation and policies, NIST 800-53, etc.. You have frameworks and standards a plenty in federal gov. Not so much on the local/state levels. So coming up with policy is a good idea, but may not be your most pressing issue.
I think you are on the right track with the review of who does what in IT. I would expand your list by finding out what everyone can do in IT. In most agencies/companies I have been with (about 10 so far) I find that the line between IT and security is very blurry with folks operating on both sides of the lines. So find out what security items are being done and by whom. Then you can help lay out your plan to help the company separate them by showing that these security items should really be done by people who do not have the rights to do them (separate the fox from the hen house). I was able to "pry" some of my security staff away from the IT department this way. If you have an audit dept, try to lean on them to do some of the auditing items, if they can. If they deny you, use that as a reason to have more staff. Lean on the Least Privilege Principle. As a former investigator you have probably seen the damage caused by insider threat. Show how having people that are able to make changes, with no one to audit their actions, and not enough people watching all of the items that need tracking could be bad for the company. Look at rights management to see if people have too many rights (i.e. IT made them a global or domain admin because it was easier than trying to figure it out on a granular level.)
One of the quickest ways to gain staff is to frame your findings in how it relates to risk to the agency.
1) Not having a policy in place means it is harder to prosecute individuals for wrongdoing.
2) Having people with too many rights raises the risk of insider threat or even incompetent admins deleting whole Active Directory OU's, yes I saw that happen.
3) Once you perform an activity, create Standard Operating Procedures (SOP's) documentation for them. This will help you document what you do in an efficient manner, it will help with policy or procedure creation, and it will prepare you to be able to hand that duty off to a staff member when you get one.
4) If you start getting overwhelmed you can look at this: Here's what I do, here's what I could be doing, and here is where I would like to go in the future. Look at the current list of tasks and prioritize them according to what you see as important. Include the risks for each item. For example; Not dealing with people clicking on links in email is more of a threat to the network than not having an email policy. Having a policy makes it easier for people to understand the expected behavior and prosecute them for violations of it. So maybe you set up a phishing response security awareness course or even just an email explaining phishing and then have a way for people to send in questionable items for review. Then write the policy.
One of my early successes at one job was shutting off USB access for 85% of the organization of over 5000 users. They had PII and other stuff being transported around on USB drives and were bringing in viruses on them. Once I proved to the CIO there was a risk to his network from viruses and had also explained the potential "lost" PII risks to him and senior management, they went with my recommendation to block them and have people that had a valid business need submit a request. Then I updated the policies around use of portable media. Then I went on to inappropriate use of company email to reduce/close that source of risk.
Also it is going to be key to understand the unspoken organizational culture. If everyone is operating out of a fear mentality, they may be reluctant to do any improvements out of fear of being scolded or punished. If they operate out of an "I don't care" attitude you might have to explain the risks in a way they can understand., etc.
And remember, security should be more like a speed bump than a stop sign. Unless they are headed for a cliff.......
