Minimum Viable Secure Product
I’m a sec eng and worked at startups, I don’t love this list. Some of it is valid but generally it seems off target  regarding how process-focused it is and ideas like startups doing data flows, vuln management and getting application-level logging done.You’ll get much more bang for buck for the product’s security by working on the enterprise and infra side - deploying EDRs (somehow not on this list?), tightening up Gsuite sharing and email settings, Okta (I see SSO on the list), anti-phishing capability, guardduty and sechub, a pw manager, getting on IaC early to support ops and sec goals,  and a lightweight SlackOps infra for security alerts. Somehow mostly none of this is mentioned.The emphasis around the application seems misguided due to how (a) pragmatically it’s going to take much longer to get appsec controls and logs vs infra and enterprise controls/logs and (b) the vector in is usually Bob and Jodie in recruiting and HR getting phished, vs an appsec breach.Also, it seems to break the golden rule of security enabling revenue with acceptable risk trade-offs and pragmatic controls. All the process in here doesn’t seem pragmatic. The controls
in here seem useful overall but not where I’d go at first to secure a fast startup.