Security basics for small software teams shipping to enterprises

Enterprise buyers will ask about security even if your product is early. You do not need a giant program on day one. You do need answers.

1. Turn on SSO or at least enforced MFA for admin accounts.
2. Keep an access list and remove leavers the same week.
3. Log authentication and privileged actions somewhere searchable.
4. Prepare a one-page vendor questionnaire response (data handled, encryption, subprocessors, incident contact).
5. Name an incident owner and a customer notification path before you need it.

These basics unblock deals and reduce panic later. Fancy tooling can wait.