Series A Security Checklist

Enable MFA on root · Store credentials offline · No access keys on root

Individual accountability · Easier to revoke access · Audit trail per user

Use Google Authenticator or YubiKey

Review IAM policies quarterly · No wildcard (*) permissions

GitHub Actions + AWS OIDC eliminates hardcoded credentials entirely

Use IAM credential reports to audit active keys

One setting protects all current and future buckets · Takes 30 seconds

SSE-S3 minimum · SSE-KMS for regulated data (HIPAA, PCI)

Enable encryption at creation · Force SSL via parameter group

API keys, DB passwords, tokens — all out of the codebase

RDS automated backups · Test restore at least once · Document the process

Default VPC is too permissive · Build a custom VPC with private subnets

No open SSH/RDP to the world · Use bastion hosts or AWS Session Manager

RDS, ElastiCache, internal services should never be internet-facing

AWS WAF on CloudFront or ALB · Blocks OWASP Top 10 attacks

Every API call logged · Multi-region trail · Logs in dedicated S3 bucket

Detects account compromise, crypto mining, unusual API calls

Aggregates GuardDuty, Inspector, Macie findings into one dashboard

CloudWatch Alarms → SNS → Slack/email · At minimum: root login alert

Captures all network traffic metadata · Essential for incident investigation

Detects drift from your security baseline · Required for SOC 2 evidence

Map every data store · Know what’s regulated · Investors will ask this

GDPR/CCPA language if you have EU or CA users · Enterprise deals require this

Review SaaS tools handling your data · Check their SOC 2 reports

Terraform or CDK · Reproducible · Auditable · Required for compliance evidence

Who to contact · Escalation path · Containment steps · Post-mortem process

Series A investors and enterprise clients will ask for this report

Phishing awareness · Password hygiene · Secure coding basics

How long to recover · How much data loss is acceptable · Investors will ask