--- CIS Top 18: --- CIS have a top 18 critical security control checklist, which is pretty incredible. https://www.cisecurity.org/controls/cis-controls-list ht

--- CIS Top 18: --- CIS have a top 18 critical security control checklist, which is pretty incredible. https://www.cisecurity.org/controls/cis-controls-list https://www.cisecurity.org/controls/cis-controls-list CIS Top 18 Version 8 works sequentially too, so you implement control 1 and it sets you up in a good place to then implement control 2, and so on. --- Cyber Essentials: --- The UK's Cyber Essentials scheme is a certification standard (but you can ignore that and just use it as a checklist if you'd like). It's designed for small to medium size organizations, and focused on getting the foundations right. This would be a useful place to start but it won't cover some of the specific threats and risks associated with software/app development. See @snowstormsun's comment about OWASP Top 10 for that. https://www.ncsc.gov.uk/cyberessentials/overview https://www.ncsc.gov.uk/cyberessentials/overview --- There's loads of other standards like this out there, that are free to use and are each focused on different security challenges etc. I've shared these two standards as they both setup a solid foundation.