Long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for security. However, as you all know, it's not as simple as a checklist, because you need to dig deeper and incorporate the configuration very well with your application logic. However, as of the time being I'm only capable of giving them checklists of configuration, I can't give them guidelines, I need to give them specific things, so I would need to use some sorta... checklists.
Where can I find an exhaustive list of configuration for IIS and SQLserver and the machines they need to reside on (separate machines, of course) and what kind of services to run, ports to open... etc