Starting an IT / InfoSec Department - Where do I start?

I have always been the "IT guy" at a company but I am now the person in charge of their IT / security.
Lots of people use frameworks and other tools but what I am missing is... how do I come up with policies and procedures? How and based on what do I create my SOPs and worst of all...what if I miss anything while creating the plan or the documents?

cybersecurity department infosec start