This list is very general (it's about high-level controls, not actual tactics) and is geared towards enterprises, so there are things on it that definitely are not startup best-practices. For example: most startups don't do any serious network monitoring (even if they do operate monitorable networks, which isn't a given).