I would prefer a minimal checklist instead: what measures give you the most (security) bang per buck (effort spent)?