Identity before features
Inventory human and machine identities, require strong authentication for privileged access and remove credentials that no longer have an owner.
Limit the blast radius
Segment sensitive data, grant the minimum practical access and make high-impact actions visible. Assume an individual control can fail.
Practice continuity
Backups, logs and incident contacts matter only when they are tested. Run a small continuity exercise and record the time, missing access and unclear decisions.