OWASP has everything you need; SAMM for policies and procedures https://owasp.org/www-project-samm/ ASVS for your application https://owasp.org/www-project-application-security-verificat...