This checklist by sqreen is pretty good too https://www.sqreen.io/checklists/saas-cto-security-checklist

I'm not affiliated - not even using their product.