Secure SaaS Platform Control

Bootstrapping, no CTO, no Dev experience, Soloprenuer – Any kind advice would be appreciated.

Any steps missing below in ME securing my SaaS platform before engaging with an offshore dev agency?

1. Setup private GitHub repository (setup approprioate permissions)
2. Set up 3 AWS Accounts (testing, staging, production) – Per customer?
3. Implement backup strategies (Clone my GitHub repository locally and automatic/manual backups for myAWS RDS databases.)
4. Manage secrets and access (Is this needed if I have IAM?)
5. Code Reviews (SonarQube, OWASP ZAP, OWASP Dependency-Check, Nessus, and penetration testing as I am hoping for SOC 2, GDPR, ISO 27)
6. Set Up Monitoring and Alerts
7. Rotate Credentials and Maintain Security thru IAM