Comment by hashimotonomora

- need to know basis.

- strict separation of concerns.

- only outbound hiring.

- no hiring of people who can be blackmailed.

- understand your threat model.

- if you were an enemy and had to break into your org, what would you do? Improve that.