The open doors, found first
An audit of what you actually run: services facing the internet, accounts nobody closed, software years behind, and backups that have never once been restored. You get a list ordered by what would hurt most, with the cost of each fix beside it.
Watched, not just configured
Hardening is a day's work. Noticing is a permanent one. We watch for what comes before an incident — new accounts, failed logins, traffic leaving at odd hours — and act on it while it is still nothing.
A plan for the bad day
Who gets called, what gets disconnected, how you get back to yesterday's data, and what you are obliged to report and to whom. Written down before you need it, and rehearsed at least once.