>if your company hasn't done anything on the checklist yet then what should come first, what is most important? Security practitioners like to use the risk ana

>if your company hasn't done anything on the checklist yet then what should come first, what is most important? Security practitioners like to use the risk analysis matrix for this exact reason. One axis is likelihood of problem occurring (ranging from unlikely to almost certain) and the other is impact problem occurring will have on the business (ranging from embarrassing to bankrupting the business). As you can immediately see this is a very good tool to focus the efforts on the right remdiations.