Here is a pretty solid list although bias towards security https://www.sqreen.com/checklists/saas-cto-security-checklis...