Saas CTO Security Checklist
It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us).What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong.Here's their "Series A" list:* No shared accounts
* Centralized account management
* Centralized logs
* Server list
* DDoS protection
* IP restrictions for internal services
* Monitor metrics
* Public security policy
* Special security for non-tech staff
* Real-time monitoring/protection
* Customer 2FA
* Monitor suspicious activities
* Security-oriented test sessionsMany of these are things you want to be doing ASAP. That doesn't mean they take priority over product/market fit, but it does mean you're not waiting for a milestone to build them. For instance: most competent teams have centralized logs. Every competent team restricts access to internal services (and IP restrictions aren't the way to do that). If you don't get this stuff started early, it's a nightmare to start later.Other things on the list are things that mature, profitable companies don't bother doing, because the ROI isn't high enough. Customer 2FA is an example --- if you need it, you probably know. Real-time security monitoring tools are another big one; chances are, if you're reading a checklist like this, your monitoring needs are too idiosyncratic to buy COTS.Post-Series-A is worse:* CloudFormation
* Incident Response
* Internal security policy
* Asset inventory
* Bug bounty program
* Security audits
* SDLCWith the exception of bug bounties, which you might not bother ever doing at all, these are all ASAP items.You could also start a list of important things they're missing:* Security testing integrated into CI/CD pipeline
* Automated routine network monitoring
* Segmenting AWS accounts
* Having a process to tag PRs for security review
* Adding a security page to your websiteThis list reads to me like it was originally shrink wrapped around a product, and then expanded with bullets with links to random websites to throw the scent off.