I would repeat user Aaronstotle's comment that smaller teams are likely not the right audience for these levels of compliance.
When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet.
Doesn't Google already have a web based, but internal only, IDE? I don't know if that'd be easy to make external, but my understanding is that they've got a lot of internal users on it.
Yeah, and Cider was getting surprisingly good at the point I left Google (I was initially a skeptic). But so much of what made it good came from its tight integration with other internal tooling. I'd be surprised if it's ever externalized in a form that captures most of that value.
When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet.
[0] https://latacora.micro.blog/2020/03/12/the-soc-starting.html