Security Baseline for Seed and Series A

The 12 controls

1. SSO on all internal tools
2. Hardware keys for admin accounts
3. Password manager mandatory
4. Encrypted laptops with MDM
5. Prod access via bastion or IAP only
6. Secrets in a manager
7. Automated dependency scanning
8. Basic WAF or Cloudflare
9. Backups tested monthly
10. Access review quarterly
11. Incident response runbook
12. Vendor security review before contract

What buys you the deal without SOC 2

A 3-page security overview + the 12 controls documented + one named security owner clears 80% of mid-market procurement.