For application development, the SANS Web App Security Checklist is good:

https://www.sans.org/cloud-security/securing-web-application...