Comment by bartman

I’ve found CIS Controls v8.1 to be good and sane, with actual benefits to security. Level 1 is a solid base, and Level 2 is good for picking from depending on where risks exist in your business.

CIS Benchmarks are worth a look too: They’re best practices for securing typical cloud platforms, SaaS and OS.