01Identity first
Shared logins make every other control meaningless. Individual accounts, enforced multi-factor authentication and immediate removal on departure are the cheapest risk reduction available.
Tie permissions to roles, not to people, so access reviews take minutes instead of a week.
02Least privilege, everywhere
Application credentials should be scoped to what the feature needs. An integration that only reads orders has no business holding a key that can delete customers.
Rotate secrets, keep them out of source control and store them in a managed secret store.
03Backups you have actually restored
An untested backup is a belief, not a control. Restore into a scratch environment on a schedule and record how long it took.
Know your recovery point and recovery time objectives, and make sure the business agrees with them in writing.
04Log what matters
Authentication events, permission changes and data exports should be logged immutably. When something goes wrong, the question is always who did what and when.