Require disk encryption and screen lock. Deploy SSO everywhere you can. Provide a password manager. No passwords in slack. If they show up they have to be rotat

Require disk encryption and screen lock. Deploy SSO everywhere you can. Provide a password manager. No passwords in slack. If they show up they have to be rotated immediately. Create a simple security policy (and password policy) to let people know expectations. Create an onboarding and off boarding checklist. Create a BYOD policy (if people choose to have work coms on their phone) Require phone password, encryption and find my device. Prohibit password reuse. Buy people yubikes if they want em. Encourage 2fa Rotate credentials at most annually. Create a culture of blameless postmortems so people feel comfortable raising concerns early. Set up your cloud accounts with SSO. Secure your CI/CD system. It usually has the keys to the castle. Deploy or enable cred-scan, dep-scan, sast-scan in CI/CD Don’t allow public items in S3 buckets unless the bucket is explicitly public.