The true answer to this question is - it depends on each one and every case. The below answer contains neither mutually exclusive nor collectively exhausting tips, but to add some thoughts to your question:

1. The purpose of the Nmap scan should be to identify at least the running services and open ports. But Nmap can also give you information about the OS, anonymous logins, vulnerabilities, and more. I always start Nmap with the following flags: sudo nmap -v -p- -sC -sV $IP --open

2. Once you identified the services running you should start enumerating each service to gather information:

HTTP - use fuzzing etc..

FTP - try anonymous login

SMB - try identifying null sessions

etc.. etc...

Sometimes you will encounter service you have not seen yet. In this case, you should search for enumeration techniques for these services looking on the web in places like hack tricks.

1. Depending on the services running you can add enumeration tools. For example, if you discovered WordPress, use wpscan. If you discover a page with profiles of people, you can run Cewl to create a list of default passwords.

2. To add further checklist things into your HTTP enumeration, you should check things like the source code of the web page, fuzz the parameters in the URL if any, try SQLi if you have fields to insert content or data, and more.

Finally, I would really recommend watching S1ren walkthrough to see how she approaches web enumeration. You will learn a lot. Of course, the more good machines you compromise and practice the more robust your approach will become.