I've recently gotten a lot of good guidance on security best practice from a new boss. A great place to start is the CIS 18 critical security controls. They cover most things for protecting an organization.

Walk through the controls list, see where you compare to the controls and sub-controls and then start to establish a path forward.