The Center for Internet Security critical controls

While CIS' critical controls aren't standards for compliance, they are certainly an excellent foundation and a good working model for any organization. The critical controls are very practical in nature – rather than being compliance-driven, they are focused on real-world attacks and defending against them. The understanding is that if you focus on the controls, in particular, if you focus on them in order, then your organization will be well defended against the more common attacks seen "in the wild." For instance, just by looking at the order, it's apparent that you can't secure your hosts (#3) unless you know what hosts are on your network (#1). Similarly, logging (#8) isn't effective without an inventory of hosts and applications (#2 and #3). As an organization works its way down the list, it quickly reaches the objective of not being the "slowest gazelle in the herd."

As with...