This pretty much sums everything up. I think Gorsuch confirmation (tomorrow) is also something that needs/needed to happen first.
I think you are right.
Trump needs to stop the bleeding first, then heal the patient, while making sure the evil doers who damaged the patient get theirs.
Bannon I think just stopped the bleeding at the NSA. Put in place Trump approved controls. Things probably like, removing access from everyone Obama, new daily or weekly reports on everyone system wide who queries in future. Preparation for punishment would be things like formal records retention (including database search queries).
Punishment can be delayed for awhile as long as systems are in place to preserve evidence. It will take awhile (still!) for Trump’s people to be put in place.
Gorsuch is so key. Watch the rogue rulings by judges on immigration and climate crap to slow or stop once he is in place, though it will take time. The 9th circus right now has free hand to legislate their collective wet dreams.