Scott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Practices" in Security Hub. [2]

[1] https://summitroute.com/downloads/aws_security_maturity_road... [2] https://aws.amazon.com/blogs/security/aws-foundational-secur...