I'm looking for some resources and hoping some of you security experts can help.
Quick Background: I recently started my first job out of college working at a small organization as a Web Developer. In addition to my development duties I also provide some basic IT support as needed. As I began providing support I quickly realized there were some Information Security concerns within the company.
My Goal: I have formal education in Information Systems and have a decent understanding of Information Security so I would like to help develop some standards and practices for the organization to implement in order to better protect against future issues.
Question: Can you recommend any resources for me to utilize as I begin to develop Information Security Standards and Practices for a small business/organization?
Current resources: A quick search returned this document - http://csrc.nist.gov/publications/nistir/ir7621/nistir-7621.pdf (I am unfamiliar with NIST but it does seem to cover most things at a basic level.)