Security professionals don't make policies and rules for the fun of it. There's a method to their madness. The Center of Internet Security created a list of 20 Critical Security Controls to help companies be a baseline of best practices in cybersecurity. This is the intro episode to the CIS and the Top 20 controls.
Be aware, be safe.