CIS and the various NSA STIGs are about the best actual prescriptive guides.

But threats occcur on a continuum - at a point (which is focused organised crime/nation state actors) you will lose...but there is still a lot of low hanging fruit you can win on.