What I have learned
The first controls should protect the most consequential paths: access to production, customer data, backups and incident escalation. A long policy that nobody follows is weaker than a short routine people can repeat.
What I would do
I would map critical assets, assign owners, require strong authentication, test restoration and make one secure default easy for every new team. I would revisit the map each quarter.