For instance:
---
"Follow an onboarding / offboarding checklist"
Do this when...
- you have ten or more employees,
- you have at least ten thousand user accounts, OR
- you have at least ten thousand dollars MRR
---
"Protect your application from DDoS attacks"
Do this when...
- you have publicly announced funding, put a major product launch or milestone in commercial press, or have publicized a key strategic hire
- a prolonged period of downtime (N minutes/breaking 3 or 4 nine availability) would have a materially adverse effect on your business
---
"Use SSL certificates to secure people using your website"
Do this when...
- you are collecting any information from visitors to your website (logins, email addresses, phone numbers)
- you would not want the traffic from sessions browsing your website to be intercepted by third parties.
Of course, a lot of these things would be obvious, but there's a chance here to make this really accessible to the security ignorant or security illiterate.