Security Review Checklist

Use this checklist for new services, high-risk changes, vendor integrations, and systems that handle sensitive data.

Scope

• System purpose and owner are clear.
• Data classification is documented.
• Trust boundaries are identified.
• Public and private ingress paths are documented.
• Third-party integrations are listed.

Identity and access

• Human access uses SSO and MFA.
• Privileged access is limited and reviewed.
• Workload identity is used where possible.
• Static credentials are avoided or rotated.
• Break-glass access is logged and reviewed.

Application and data

• Authentication and authorization are tested.
• Sensitive data is encrypted in transit and at rest.
• Logs avoid secrets and regulated data.
• Retention and deletion expectations are documented.
• Input validation and abuse controls are considered.

Delivery and supply chain

• Dependencies are scanned.
• Container images or artifacts are scanned.
• CI/CD permissions are least privilege.
• Artifact identity and provenance are recorded where required.
• Secrets are not stored in source control or pipeline variables.

Evidence

• Required controls map to evidence sources.
• Exceptions have owners and expiry dates.
• Open risks are tracked in the risk register.