The NIST Cybersecurity Framework for small businesses is a great starting point for developing and nurturing a healthy cybersecurity program in a startup.

https://www.nist.gov/itl/smallbusinesscyber

https://www.nist.gov/itl/smallbusinesscyber/nist-cybersecuri...

At my company, the big thing that I think would help is if people would stop treating data engineers as if they are a cheap way to get both software engineering + data analytics in one package. They’re not. Data engineers are brilliant at data things like writing complex pipelines and wicked queries, but they just aren’t as good at writing secure code. Meanwhile, software engineers are the opposite.

Data engineering teams need at least part of their team to be designated software or systems engineers that are experts in stuff like how to create a robust cloud environment. This is not only beneficial for security, but also for cost optimization, performance, operations, etc! It drives me crazy when I see a data engineer or marketing team told they have to fend for themselves when trying to figure out how to build a cloud environment.

In theory, there are documents out there a startup can read, understand, and follow to get reasonable outcomes. Theory is a wonderful place, I'm told. I'd like to visit someday.

In practice, the answer is to hire a consultancy. There are fractional CISO services out there. It's very likely that a startup without significant security experience in-house does not have the expertise to make good use of any guidance they can find. Every scenario is too specific, every personality dynamic too unique, and every new technology question too novel for there to be easy pre-fab answers that a non-security-practioner can find, understand, and apply in a correct and consistent manner.