For a healthtech startup, the first 90 days of secure engineering should cover four areas in this order: stop sensitive data reaching logs, review the vendors that touch data, control dependency intake and put release controls in the pipeline. Each is small, checkable and produces a record you can show a buyer.
Why this order
Logs and vendors come first because data that leaks into them spreads fast and is hard to retrieve. Dependencies and releases come next because they decide what code runs in front of patient data. This plan is high level and general, not legal advice or a compliance program.
Days 1 to 30: logs and data
- Write the never-log list: secrets, session material, direct identifiers, clinical content and free text.
- Replace raw object logging with an allowlist logger.
- Check URLs and access logs for identifiers and query strings.
- Tag database columns by sensitivity so tools can enforce the rules.
- Limit who can read production logs, and use named accounts.
The OWASP Logging Cheat Sheet is a good reference for this stage. It covers what to exclude, how to protect logs and retention.
Days 31 to 60: vendors and scripts
- List every vendor and SDK that receives data from the app or the web properties.
- Rank them by what they receive, not by size.
- Review the top tier with a short question set: data fields, access, retention, deletion, subprocessors, incident notice.
- Remove third-party scripts from pages behind login unless a written reason exists.
- Ask counsel which vendors need additional agreements for your situation.
Days 61 to 90: dependencies and releases
- Require an intake form for new dependencies.
- Install from the lockfile in CI and fail on mismatch.
- Add a dependency scan with a failing severity threshold.
- Turn on branch protection: required reviews, required checks, no admin bypass without a logged path.
- Write the emergency release path.
- Save a release record every time you ship.
A scoreboard
| Area | Done when |
|---|---|
| Logging | Never-log list in repo, allowlist logger in use |
| Data | All columns tagged, CI checks new ones |
| Vendors | Top tier reviewed and recorded |
| Dependencies | Intake form and scan gate active |
| Releases | Protection on, records saved |
Update it monthly in a short meeting. Progress you can see keeps the work from stalling.
What to leave for later
Do not start with a policy library or a certification project. Start with controls the pipeline can enforce, and let the records accumulate. Formal programs build on that evidence.
Try it yourself
Click through it at your own pace, or open it full screen.
Explore how findings are prioritized, which is the idea behind the severity threshold in the dependency step.
Where Safeguard fits
Safeguard covers dependency and SBOM scanning, reachability analysis, policy gates and compliance and evidence automation, which line up with the last 30 days and the record keeping throughout. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is 90 days realistic for a small team?
For this scope, yes, if one person owns it and each step is kept small. Cut scope before extending the timeline.
Does finishing the plan mean we are compliant?
No. It builds engineering controls and records. Compliance with any regime is a separate assessment.
Sources
Last reviewed: 19 October 2026.
