The CIS Controls are internationally recognized for bringing together expert insight about threats, business technology, and defensive options into an effective, coherent, and simpler way to manage an organization’s security improvement program. This page shows a dynamic list of CIS Sub-Controls that can be filtered according to Implementation groups and specific mappings. It allows people to get started with creating a document to help get started implementing a security based framework. I am posting it here as a lot of people ask about how to get started implementing security at a business level and this free tool can be very helpful.
https://www.cisecurity.org/controls/cis-controls-implementation-groups/