CIS security benchmarks are the de facto standard for security settings. Most of the peneration and security testing tools use these guides to generate security reports.
They are extensive and you should try and follow these standards to ensure the best levels of security of your web server.
The latest are available here:
https://benchmarks.cisecurity.org/downloads/browse/?category=benchmarks.servers.web.iis
