The Aus Government has a good guide called the "Essential Eight" for reducing risk. It's a good starting point for businesses, and is pretty much universal advice, not just applicable to government departments: https://www.cyber.gov.au/publications/essential-eight-explai...

My take on the E8: https://blog.congruentlabs.co/essential-eight-essentially/