Your request is very light on on Details, specifically which worm where you struck with, what was you security policy prior to the outbreak, and what is "taken appropiate steps"?
First, I would review my own security policy for holes or problems. If I didn't have a security policy, I would give up on figuring out how I was struck and assume it was my own fault for not having a solid security policy (I even have a security policy for my home machine, it is not written, but I follow it carefully and I have not in 5+ years been unintentionally struck by a virus).
Second, I would look for places where the security policy was not followed. I would use logs/event viewers on Servers, PCs and Routers until had a good idea what happened, in a multi user environment I would try to ask a few questions of the users who first noticed the outbreak, and clearly communicate that they are not in trouble (assuming I am allowed to make that call) and that their help is important. I would probably take several steps based on the information gathered here.
Third, I would update the security policy or my enforcement of it so that this would never happen again. This may mean installing updates in a more timely fashion, adding Antivirus to servers or PCs, tightening firewall rules, or maybe even educating users on why downloading smiley packs is a very bad idea. At this point I would also determine whether calling the authorities is an appropriate step. Many times I have contacted no one, twice it was escalated to the authorities.
Finally, I would perform an ongoing review of the security policy and check that the enforcement of it is a working. I would do this using a variety of non-intrusive methods, and anytime something was instrusive I would clear it with those involved, and I will always be aware of the cost vs the benefit (no use overdoing security and getting in the way of those trying to do the work).
I know it is vague, but this is how I have done it. I have successfully identified a few threats this way and I have protected the teams I have worked with from many more. I have missed many more, but I used them all as an opportunity to make the system and workflow better. I also know that with a good security policy one could make it theoretically impossible to hack/infect, even when using numerous windows PCs or other perceived insecure platforms. The reality is quite different because things never work exactly as planned. The idea is to have the gray area, where theory and reality meet up, be secure enough to prevent all the big problems and be usable enough to let people and the system work (or play or accomplish whatever goal).