Let me share my (unpopular) opinion: whatever minimum mandated by the applicable laws, and nothing else. If you are not a bank, and don't have EU customers, it

Let me share my (unpopular) opinion: whatever minimum mandated by the applicable laws, and nothing else. If you are not a bank, and don't have EU customers, it could as well be an empty checklist. If you need anything more, you are not a startup. Well, if you disagree, let me add one item to your checklist: know when to stop expanding it. Rationale: I have seen enough organizations with the checklist-based approach to security. In all of them, it had nothing to do with actual security, but with convincing customers that the organization is safe to deal with - even if it is in fact false. People responsible for filling in such questionnaires often had an outdated vision of the practices of the company. Also, once you allow any checklist in, or hire any so-called cybersecurity expert who is actually a checkbox-ticking expert, you will be under constant pressure to strengthen this "security posture" more and more, way beyond reasonable. Hypothetical example: this expert decides that you have to comply with Cyber Essentials, and one of the requirements is to install, on each laptop and desktop, an antivirus that can live-check all of the web pages loaded in browsers. But no such desktop-ready thing exists for Linux, and this expert will tell you to stop using Linux on desktops, thus leading to mass-resignation of developers. While the proper solution would have been "don't deal with the UK government".