Security & Sensitive Data Review Checklist (internal and external)?

Hello,

I need to develop a security and sensitive data review checklist - both for internal (behind the customer's firewall) and external (outside the customer's firewall).  For example, as an internal checklist we would look at things such as are laptop hard drives encrypted?  Do employees carry any sensitive data on their laptops?  Are workstation screen savers enabled with password protection? etc.  For external I would look at things like do they have a wireless access point?  If so, is WEP or WPA enabled?  Is the broadcast of the SSID turned off?  Have they had anyone do a probe of their main firewall to look for holes? etc.

Rather than start from scratch I was hoping someone could point out a list or online document that might match the criteria I've set forth above - something I could leverage as a starting point.

Any pointers are appreciated.  Thanks!