My first post... so still feeling my way around. Anyhow, I thought I'd start with a recommendation (which I think I found originally because it ends in '.to', like my domain). Us Tonga domain owners are few and far between!
Back to the thread: I found sometime ago a set of online security policies which have been a decent reference source. The good news is that they are free to access (albeit promoting some other stuff), but free nonetheless:
I've posted this in its own thread because all the other recommendation threads seem to cover software.
Hope it is of interest.