Quick checklist that saved us time. Rotate credentials on a calendar, not only after incidents. Run a pre-mortem; it surfaces surprises early.