Add me to that list. Backups should always be first. Then security - hopefully disable the sa login. If not, work to get it done.

The indexing and statistics are each pretty big topics. There's a lot of research and learning to do. My advice would be to not try to write your own until you get through your list. In the interim, go with something that's already built. Whatever you do, listen to Gail and don't use the maintenance plan.

You've got your work cut out for you. The good news is that you'll learn a lot going through them.

Edit: I use SQL Sentry for monitoring my instance. It isn't free, but it does a good job. There are other products on the market, including one from Red Gate.

If you have to get these things done quickly and don't have the time to spend learning all this stuff, you might be better off hiring a consultant to help you get things under control. There are a several on this site. They certainly wouldn't be free, but very likely worth it.