The starter controls your business needs to answer security questions by the book. Everything here is free to download.
GRC Basics: 10 Starter Controls
Governance, Risk, and Compliance in plain English, with the 10 controls small businesses start with.