This checklist, built by benchmarked, helps CTOs secure their apps and organizations. Each item is tagged by company stage: Bootstrap, Startup, or Scaleup.

---

🔐 Account & Identity Protection

• Enable 2FA for critical services (Bootstrap, Startup, Scaleup) Use hardware keys or app-based 2FA (not SMS). Apply to Gmail, AWS, Slack, etc.
• Use DMARC to secure your email (Bootstrap, Startup, Scaleup) Blocks phishing and email spoofing.
• Encourage personal 2FA for social accounts (Bootstrap, Startup, Scaleup)
• Enforce single sign-on (SSO) across apps (Scaleup)
• Establish onboarding/offboarding checklist (Bootstrap, Startup, Scaleup)
• Conduct regular access reviews (Startup, Scaleup)

---

🧠 Team Awareness & Training

• Run phishing drills (Startup, Scaleup)
• Get everyone accustomed to basic security practices (Bootstrap, Startup, Scaleup)
• Avoid sharing sensitive company data with AI tools like ChatGPT (New for 2024)

---

🛠 Device & Endpoint Security

• Enable full-disk encryption on devices (Bootstrap, Startup, Scaleup)
• Use automatic screen lock (Bootstrap, Startup, Scaleup)
• Use next-gen antivirus on employee devices (Scaleup)

---

🌐 Network Security

• Use a VPN for your entire team (Bootstrap, Startup, Scaleup)

---

🗂 Regulation & Compliance

• Check your regulation and compliance requirements (e.g. GDPR, NIS2) (Bootstrap, Startup, Scaleup)
• Test your database recovery plan (Bootstrap, Startup, Scaleup)

---

💳 Financial Controls

• Use virtual credit cards with limits (Startup, Scaleup)
• Enable cloud budget alerts (Bootstrap, Startup, Scaleup)

---

☁️ Cloud & Infrastructure

• Back up, then back up again (Bootstrap, Startup, Scaleup)
• Use CSPM tools (e.g., AWS Inspector, Cloudsploit) (Startup, Scaleup)
• Keep dev/staging/prod cloud accounts separate (Startup, Scaleup)
• Update OS and Docker containers (Startup, Scaleup)
• Scan Docker images for vulnerabilities (Startup, Scaleup)
• Restrict deployment credentials by IP (Startup, Scaleup)
• Monitor cloud for cost anomalies (Startup, Scaleup)
• Monitor servers for performance anomalies (Startup, Scaleup)
• Monitor subdomain takeover risks (Startup, Scaleup)
• Make infrastructure reproducible with IaC (Scaleup)

---

🧱 App & API Security

• Protect against DDoS with Cloudflare/CDN (Startup, Scaleup)
• Use SSL certificates (Bootstrap, Startup, Scaleup)
• Check website security configuration (Bootstrap, Startup, Scaleup)
• Use a Web Application Firewall (WAF) (Scaleup)
• Run DAST (Dynamic App Security Testing) tools (Startup, Scaleup)
• Use strict CSP headers (no inline JS) (Bootstrap, Startup, Scaleup)
• Block cross-account data leaks in SaaS (Bootstrap, Startup, Scaleup)

---

🔐 Code & Development Practices

• Enforce a secure code review checklist (Bootstrap, Startup, Scaleup)
• Use static code analysis tools (e.g., Semgrep) (Bootstrap, Startup, Scaleup)
• Use lockfiles to freeze dependencies (Bootstrap, Startup, Scaleup)
• Check dependencies for EOL and vulnerabilities (Startup, Scaleup)
• Keep secrets separate from codebase (Startup, Scaleup)
• Never build your own crypto primitives (Bootstrap, Startup, Scaleup)
• Check for malware in packages (e.g., with Socket, Phylum) (Startup, Scaleup)
• Implement Secure Development Life Cycle (SDLC) (Scaleup)
• Run Docker containers with restricted privileges (Bootstrap, Startup, Scaleup)
• Check your JWT algorithm configuration (Bootstrap, Startup, Scaleup)

---

📡 API & Customer-Facing Security

• Offer 2FA or SSO in your own app (Startup, Scaleup)
• Offer public APIs with OAuth2 + refresh tokens (Startup, Scaleup)
• Enforce password policy for end users (Bootstrap, Startup, Scaleup)

---

🕵️‍♂️ Incident Readiness

• Hire external penetration testers (Scaleup)
• Set up bug bounty programs (e.g., Intigriti) (Scaleup)
• Run “what-if” drills: what happens if a vendor is breached? (Scaleup)

---