Welcome Daniel. The checklist for a new organisation on the Security page is a good place to begin: a passkey plus a backup passkey for every owner and admin, Require two-step verification for every member once everyone has a second factor, at least two owners or admins, and field staff on the User role. Device profiles on TLS only (port 8883) and allowed networks for fixed sites are on the same list.