> several of the most savvy security teams I mean the list isn't for savvy security teams. Or, I'd say, not even for companies with any kind of security team.

> several of the most savvy security teams I mean the list isn't for savvy security teams. Or, I'd say, not even for companies with any kind of security team. For the typical startup with zero people with any security experience, it's something they can do. If they get to a point of hiring a security team, they're past the point of needing such a starter list. > Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18 --- LOL to this whole line item. That's silly to say. You must comply with regulations that apply to your industry. Try setting up a bank and just LOL at banking regulations (SBF?). Of course, if none apply to your industry, ignore them all.