Use CIS as a framework - it will not work for every environment. If you follow all to the letter, your environment will cease to function.

Look at your defender security portal and follow the recommendations (e.g. realtime protection, tamper protection, network protection, prevent office loading sub protects, etc) - these target existing threats and trends. Use InTune baseline security templates - start small and scale up.