You might consider starting with something like the CIS Controls Framework: https://www.cisecurity.org/controls/cis-controls-list.