@accidentalciso Not sure if it helps anyone, but this is my current readiness checklist for applications.

Privileged Access Management
☐ Privileged access approvers list (group or individuals)
☐ Data access approvers list (group or individuals)
☐ Roles identified for PAM
☐ Targets identified for PAM
☐ Service accounts identified
☐ Secret inventory completed
☐ Secret rotation procedures written
☐ Access review strategy and schedule written
☐ MFA implemented
☐ Break-glass accounts created
Secure Configuration Management
☐ Unnecessary features/ports/services disabled
☐ Patch/update strategy defined
☐ Inventory added to CMDB with owners
☐ Baseline Configurations documented/exported
Detection Engineering
☐ Authentication logs sent to SIEM
☐ Administrative activity logs sent to SIEM
☐ Logging levels configured to capture security events
☐ Special IOC development
☐ Special rule development
Incident Response
☐ Determine SOAR necessity
☐ Endpoint isolation strategy
☐ Identity isolation strategy
☐ Downtime procedures documented
Incident Recovery
☐ Application operational/functional check procedure
☐ Service/system restart dependencies document
☐ Backup & Recovery test schedule