If you do proper 2FA, always change the default credentials (including dev/test/temporary systems!) and test the recovery of your backups you're probably above

If you do proper 2FA, always change the default credentials (including dev/test/temporary systems!) and test the recovery of your backups you're probably above the median already. Logging turned on, and preferably centralized is also low-hanging fruit. For an early stage startup I feel that some unnecessary risks are caused by the lack of separation of privileges because a few people do have the rights to do everything. I'd recommend having your key people keep a separate account for privileged actions so that you're not reading your email with an account that has the access to the keys of the kingdom, that you're not doing stuff on your cloud provider with a user account that has the privileges to accidentally delete everything. Have the superuser accounts on all the third-party systems be something that you use rarely, make a limited account for your daily work.