Ugh, it's hard. You can outsource as much as possible and minimize your surface area, those are the two approaches I have used, but the auditor expense is the biggest blocker. A few years back you could find auditors for $5-6k, but I think the security/audit service providers have eaten a lot of that market.