Cybersecurity Checklist for Startups: 20 Things to Do Before Your First Enterprise Client

You are a startup. You are moving fast, shipping features, winning customers. Security feels like something you will get to "later." And then an enterprise prospect sends you a security questionnaire with 200 questions, and suddenly later is now.

This checklist gives you the 20 things that matter most — ordered by impact and effort. Start with the first 10, which give the biggest risk reduction for the effort. All 20 together prepare you for the security questionnaires enterprise clients send.

Foundation (do these first)

1. Enable multi-factor authentication everywhere

MFA on every account — email, cloud provider, code repositories, admin panels, payment systems. Users who enable MFA are significantly less likely to be hacked (CISA). If an attacker gets a password from a phishing email or data dump, MFA is the wall between them and your systems. Prefer phishing-resistant methods such as hardware security keys or passkeys (FIDO/WebAuthn), then authenticator apps; SMS codes are the weakest option because they can be intercepted or redirected by SIM swapping. Any MFA is still better than none.

2. Use a password manager

Every employee should use a team password manager (1Password, Bitwarden, or similar). No passwords in spreadsheets, sticky notes, Slack messages, or shared documents. The password manager generates unique, strong passwords for every service and eliminates password reuse, so a password leaked in someone else's breach cannot open your accounts.

3. Encrypt data at rest and in transit

Ensure all data is encrypted in transit (TLS/HTTPS everywhere) and at rest (encrypted databases, encrypted disks). Most modern cloud providers offer this by default, but verify it is actually enabled. Encryption is also your best friend under GDPR — if breached data was encrypted so it is unintelligible to anyone without the key, you do not have to inform the affected individuals (Article 34(3)(a)), and the security measures you had in place count when a fine is set (Article 83(2)(c) and (d)).

4. Implement least-privilege access

Not everyone needs admin access to everything. Apply the principle of least privilege: each person gets only the access they need to do their job. Review access quarterly. When someone leaves the company, revoke all access the same day — not next week, not "when IT gets around to it." Accounts that stay active after someone leaves are an easy way in that nobody is watching.

5. Keep software updated

Enable automatic updates on operating systems, browsers, and applications wherever possible. For servers and infrastructure, establish a patching schedule — critical vulnerabilities within 48 hours, everything else within 30 days. Unpatched software is a common entry point. The 2017 Equifax breach, which exposed the personal information of about 147 million people, started in mid-May through an Apache Struts vulnerability that had been fixed in March.

Documentation (your enterprise clients will ask for these)

6. Write an Information Security Policy

This is the document that says "we take security seriously and here is how." Every enterprise security questionnaire asks for it. It does not need to be 50 pages — a clear, honest 5-10 page document covering your security principles, responsibilities, access management, data handling, and incident response is sufficient for a startup. Our Security Policy Generator can create one for you in minutes.

7. Document your incident response plan

What happens when something goes wrong? Who gets called, in what order? How do you contain the damage? When do you notify customers? Under NIS2, you have 24 hours to file an early warning. Under GDPR, 72 hours to notify the DPA. Under DORA, financial entities send an initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. You cannot meet any of these deadlines if the plan does not exist before the incident. See our complete IRP guide for step-by-step instructions.

8. Create a data inventory

Know what personal data you collect, where it lives, how it flows through your systems, and who has access. It is the basis of the record of processing activities required by GDPR Article 30 and is the foundation for everything else — you cannot protect what you do not know you have. Our Data Flow Mapping Tool helps you document this visually.

9. Establish a privacy policy

If you collect any personal data from users or customers (and you almost certainly do), you need a privacy policy that meets GDPR transparency requirements. It must clearly state what data you collect, why, on what legal basis, how long you retain it, who you share it with, and how individuals can exercise their rights. No legalese walls — clear, plain language.

10. Set up a vendor register

List every third-party service that touches your data or systems. For each vendor, document what data they access, where they store it, and what security commitments they have made. NIS2 requires supply chain security (Article 21(2)(d)). GDPR requires a data processing agreement with every processor (Article 28(3)). Your enterprise clients will want to see that you manage vendor risk. Our Vendor Risk Assessment tool helps you evaluate each vendor systematically.

Checkpoint: If you have completed items 1-10, you are in better shape than most startups. You have the technical basics, the documentation foundation, and the vendor awareness. The next 10 items build on this foundation.

Hardening (level up your security posture)

11. Conduct a vulnerability scan

Run an automated vulnerability scan on your external-facing systems. Tools like Nmap, Nessus, or Qualys can identify open ports, outdated software, misconfigurations, and known vulnerabilities. Do this at least quarterly. Many free and affordable options exist — there is no excuse for not scanning.

12. Implement endpoint protection

Every company device should have endpoint protection (antivirus/EDR) installed and centrally managed. This includes laptops, desktops, and any devices accessing company data. Enable full-disk encryption on all laptops — a stolen laptop with encrypted disk is an inconvenience, not a data breach.

13. Secure your code pipeline

Protect your source code repositories (branch protection rules, code review requirements). Never hardcode secrets — use environment variables or a secrets manager. Enable dependency scanning to catch vulnerable libraries. If you deploy software, your code pipeline is a critical attack surface — a compromised deployment can push malicious code to every customer simultaneously.

14. Set up centralized logging

Collect logs from your critical systems in a central location with at least 6 months of retention. When an incident happens, logs are your forensic evidence. Without them, you cannot determine what happened, what data was affected, or how to prevent recurrence. At minimum, log authentication events, admin actions, data access, and system errors.

15. Test your backups

Having backups is not enough — you need to verify they actually restore. Schedule a quarterly backup restoration test. Verify that your Recovery Time Objective (how fast you can restore) and Recovery Point Objective (how much data you can afford to lose) are acceptable. Ransomware attackers specifically target backup systems — ensure backups are stored separately from production and are immutable or air-gapped.

Maturity (enterprise-ready)

16. Run security awareness training

Your team is your biggest attack surface and your best defense. Run security awareness training for all employees — covering phishing recognition, social engineering, data handling, password hygiene, and incident reporting. NIS2 requires cybersecurity training for staff (Article 21(2)(g)) and for members of management bodies (Article 20(2)). Make it practical and engaging, not a checkbox exercise.

17. Conduct a penetration test

Hire an external penetration tester to try to break into your systems. A good pentest simulates real-world attacks and identifies vulnerabilities that automated scanners miss — logic flaws, business logic bypasses, privilege escalation paths, and chained exploits. Enterprise clients increasingly require annual pentests as a contractual obligation.

18. Assess your cybersecurity maturity

Use a structured framework to evaluate where you stand across all security domains. The NIST Cybersecurity Framework provides a clear structure: Govern, Identify, Protect, Detect, Respond, Recover. Our Cybersecurity Maturity Assessment walks you through all 6 functions and gives you a radar chart showing your strengths and gaps. A sensible first target is Level 3 (Defined) on the assessment's five-level scale in every function. The framework itself uses four Tiers (Partial, Risk Informed, Repeatable, Adaptive) to describe how you govern and manage risk.

19. Check your regulatory compliance

Depending on your sector, size, and where you operate, various EU regulations may apply. GDPR applies to virtually everyone handling EU personal data. NIS2 applies mainly to medium-sized and large entities in the 18 sectors of its Annexes I and II, and to some entities regardless of size (Article 2). DORA applies to financial entities. Use our NIS2 Readiness Check and DORA Compliance Checker to determine what applies and where you stand.

20. Consider certification

ISO 27001 and SOC 2 Type II are the gold standards that enterprise clients look for. They take real time and audit fees, but they give independent validation of your security programme, and many customers accept a certificate or report in place of a long questionnaire. If you sell to enterprises, that reduces sales friction. Start by building your security programme using this checklist — certification is the formalization of what you are already doing.

Priority order if you can only do 5 things

If resources are truly limited, these five items give you the most security per hour invested:

1. MFA everywhere — blocks attacks that rely on a stolen password alone.
2. Password manager — eliminates password reuse across your team.
3. Encryption — protects data even if systems are breached.
4. Automatic patching — closes known vulnerabilities before attackers exploit them.
5. Incident response plan — ensures you can handle the inevitable when it happens.

Everything else builds on this foundation. Start here, expand from there.

Where do you stand? Take our free Cybersecurity Maturity Assessment to see how you score across 6 NIST CSF functions — it takes 10 minutes and gives you a visual radar chart of your security posture.

Further reading: How to Write an Incident Response Plan · Vendor Risk Assessment Guide for Startups