Minimum Viable Secure Product
I’m a sec eng and worked at startups, I don’t love this list. Some of it is valid but generally it seems off target  regarding how process-focused it is and ideas like startups doing data flows, vuln management and getting application-level logging done.<p>You’ll get much more bang for buck for the product’s security by working on the enterprise and infra side - deploying EDRs (somehow not on this list?), tightening up Gsuite sharing and email settings, Okta (I see SSO on the list), anti-phishing capability, guardduty and sechub, a pw manager, getting on IaC early to support ops and sec goals,  and a lightweight SlackOps infra for security alerts. Somehow mostly none of this is mentioned.<p>The emphasis around the application seems misguided due to how (a) pragmatically it’s going to take much longer to get appsec controls and logs vs infra and enterprise controls/logs and (b) the vector in is usually Bob and Jodie in recruiting and HR getting phished, vs an appsec breach.<p>Also, it seems to break the golden rule of security enabling revenue with acceptable risk trade-offs and pragmatic controls. All the process in here doesn’t seem pragmatic. The controls
in here seem useful overall but not where I’d go at first to secure a fast startup.