Resources for building a cybersecurity program

Besides NIST are there recommended resources for building out a security program?
I’ve been moved into a position where I have the opportunity to create a formal security program. I’m looking off suggested reading around assessment, strategy, and governance.

assessment cybersecurity cybersecurity program governance nist opportunity program resources security security program strategy