It took Mark Zuckerberg a while to find his voice, amid the biggest reputational challenge his company has faced. But the Facebook (FB) CEO now seems to have a plan, along with the money and technical know-how needed to enact it.

After letting subordinates do most of the talking for months, Zuckerberg finally showed up on Capitol Hill and took responsibility for problems plaguing his company. “It’s clear now that we didn’t do enough to prevent [our] tools from being used for harm,” Zuckerberg told a Senate committee on April 10. “That goes for fake news, foreign interference in elections, and hate speech, as well as developers and data privacy. We didn’t take a broad enough view of our responsibility, and that was a big mistake. It was my mistake.”

That’s the right tone for explaining how Russian operatives created at least 470 accounts and 80,000 Facebook posts that reached a staggering 126 million people during the last election cycle. For explaining how research firm Cambridge Analytica accessed unauthorized data on 87 million Facebook users and later used that data while working on behalf of Donald Trump’s political campaign. For explaining why Facebook has been habitually dismissive of the concerns Zuckerberg now claims to share himself.

But will Zuckerberg act convincingly? Will the company change? Quite possibly so. Zuckerberg arrived on Capitol Hill with some meaningful deliverables. He seems to have gotten religion regarding abusive practices on Facebook, and his company seems to be pivoting in a direction that could benefit all of social media.

There are three basic steps to solving big institutional problems like the ones Facebook faces right now. First you have to recognize the problem, including its full scope. Then you have to identify solutions, regardless of the cost. Finally, you have to follow through, including a thorough and if possible quantitative assessment of whether you succeeded. If you didn’t, you’re not done.

[Check out our survey revealing how many Facebook quitters there are.]

These steps might sound simple, but corporate crises often fester amid pressure to protect profitability, resistance to uncomfortable changes and the mere difficulty of reforming big institutions. Facebook failed in its initial response to complaints about political maneuvering on its platform during the 2016 elections, when Zuckerberg said it was “crazy” to think anything like that could have gone on.

Zuckerberg now acknowledges he was wrong. He has identified the problem, even if reluctantly. He has also developed concrete steps to address it, which is a lot better than the vague reassurances we got from Zuckerberg and other Facebook execs as recently as a few weeks ago. Among other things, Facebook says it will now specifically authorize anybody running a political ad on its platform—an important step that should help identify who’s doing what, instead of allowing agitators to hide. Facebook will also require users running “large pages” to be verified, to prevent poseurs with hidden agendas from circulating propaganda. These steps won’t chase every jerk off of Facebook. But they’ll help patch the gaping hole in social media, which up till now has been the ability to hide behind a fake identity.