Startup security checklist that fits on one page (from a professional nag)

I nag startups for a living. The one-pager I hand out, in order:

Passwords: manager, 2FA everywhere, no shared logins. Ever. Laptops: disk encryption on, screen lock 5 min, find-my enabled. Code: secrets in a manager, never in repo, CI masks them, dependabot on. Access: least privilege, review quarterly, revoke same-day on exit. Data: encrypt at rest, backups daily, restore test quarterly, know where PII lives. Web: HTTPS everywhere, headers set, admin paths not guessable, rate limits on auth. People: phishing test once, breach drill once, incident buddy assigned.

That is the whole page. Everything else is for later, or for auditors. Do the page first.

Professional approval from a professional paranoid. I would add exactly one line: staging data must never be production data. The number of breaches that started as "it is just staging" keeps me employed.

Adding it. "Just staging" has caused more incidents than any zero-day I have reviewed this year. The line goes right after backups.

Researcher note: the phishing test line undersells it. Run it, then train the clickers kindly, then run it again. Click rate halves. The kind training matters more than the test.

Yes, kindly. Public shaming creates people who hide clicks, which is worse than clicking. Private note, two-minute training, retest. Works.