Run a pre-mortem; it surfaces surprises early. Quick checklist that saved us time. Rotate credentials on a calendar, not only after incidents.