Are you a new security manager in your company?

You have been told by your boss that you will be replacing the current security manager within her company. Your boss explained to you that operational security measures have not been carried out in a sandard fashion, so some systems have proper security configurations and some do not. Your boss needs to understand how dangerous it is to have some of the systems misconfigured, along with what to doin this situation.
So,
What you needs to ensure the operations staff creates for proper configuration standardization?
Which kind of the practices is the best way for you to illustrate your boss the dangers of the current configuration issues?
Which most likely solutions that you will come up with and present to your boss?