"Penetration testing if necessary."
If necessary? Seriously? You are trying to tell me that you are not convinced that someone who should do all of the other steps listed might not need to worry about security?
If necessary? Seriously? You are trying to tell me that you are not convinced that someone who should do all of the other steps listed might not need to worry about security?
You're often much better off saying that your site has a certain level of security because it's built in default thing X until it grows a bit.
Generally you'll know already if you're in a market or field where penetration testing is absolutely necessary(finance, health, well known brands etc) and it won't be a question.
In all of the above cases I would consider security while creating, but I wouldn't do a lengthy pen test while trying to get the product out there. Of course that's also dependent on your target audience.
There is really no point in us discussing this further. We have dramatically different assumptions on the importance of security and the value of a company's image/reputation.