I made edits to this question to narrow the scope of the question so it does not read like a "shopping" question which is out of scope per community guidelines.
I have done a lot of work in cybersecurity and believe can provide a solid answer from past work experience in consulting with clients. Best practices already exist for what the OP is looking for, and I think the "one size fits all" approach being sought is incorrect.
Can we vote to re-open this question?