CIS Controls

The CIS Controls are an ordered list of safeguards, grouped so that smaller organisations can start with the first set.

The ordering is the useful part: it is an opinion about what to do first, which most frameworks decline to offer. For an organisation that does not know where to begin, working down the list in order is a defensible strategy and considerably better than trying to address everything simultaneously.