I've done the sysadmin, DevOps, SRE journey. A couple of others spring to mind: - if you're not regularly testing your backups, you don't have backups - moni

I've done the sysadmin, DevOps, SRE journey. A couple of others spring to mind: - if you're not regularly testing your backups, you don't have backups - monitor SSL certs for expiry. It's amazing how many outages I've seen because this was missed. - are you allowing direct connection to your server from the internet, or do you want to go through a bastion host. Do you need 2FA on this, say because you need to meet ISO27001. - do all the above through CM (like Ansible or Puppet) for obvious reasons.