# Security Checklist **System / release:** _______________ **Date:** _______________ **Completed by:** _______________ **Reviewed by:** _______________ (not the author) > Ordered by what actually gets exploited, not by framework section number. > Mark N/A with a reason — a blank is not an answer. --- ## 1. Identity and access - [ ] Multi-factor authentication enforced for all administrative access - [ ] No shared accounts; every action attributable to a person - [ ] Least privilege applied — reviewed, not assumed - [ ] Service accounts scoped to one purpose, not reused - [ ] Access review completed within the last quarter - [ ] Leaver process removes access same-day - [ ] Default credentials changed everywhere - [ ] Session timeout and invalidation on logout verified ## 2. Secrets - [ ] No credentials, keys or tokens in source control (history checked, not just HEAD) - [ ] Secrets held in a secret store, not environment files committed by accident - [ ] Rotation possible without downtime, and someone knows how - [ ] Secrets not written to logs, error messages or crash dumps ## 3. Data - [ ] Personal data identified and its lawful basis recorded - [ ] Encrypted in transit (TLS 1.2 minimum; 1.3 preferred) - [ ] Encrypted at rest where the platform supports it - [ ] Retention period defined and enforced, not aspirational - [ ] Test environments use masked or synthetic data - [ ] Backups tested by restoring, within the last quarter - [ ] At least one backup copy offline or immutable ## 4. Input and output - [ ] All input validated server-side (client-side validation is UX, not security) - [ ] Parameterised queries throughout — no string-built SQL - [ ] Output encoded for its context - [ ] File uploads: type, size and content checked; stored outside the web root - [ ] Error messages reveal nothing about internals to end users ## 5. Interfaces and dependencies - [ ] Every external interface authenticated and rate-limited - [ ] Dependencies scanned for known vulnerabilities; criticals resolved - [ ] Dependency versions pinned - [ ] Third-party services reviewed for what data they receive - [ ] Unused endpoints, ports and services removed ## 6. Configuration - [ ] Debug modes and verbose errors disabled in production - [ ] Security headers present: HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - [ ] Directory listing disabled - [ ] Administrative interfaces not reachable from the public internet, or MFA-gated - [ ] Non-existent pages return a real 404, not a soft 200 ## 7. Logging and detection - [ ] Authentication successes and failures logged - [ ] Privileged actions logged with actor, time and before/after - [ ] Logs stored where an attacker with system access cannot edit them - [ ] Logs contain no passwords, tokens or full personal records - [ ] Someone is responsible for looking at them ## 8. AI-specific surface > Complete this section if any component uses a language model. > Aligned to the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for > Agentic Applications (2026). **Model layer** - [ ] Prompt injection considered: what happens if retrieved or user content contains instructions? - [ ] Untrusted content clearly delimited and never concatenated into the instruction block - [ ] System prompt treated as non-secret — assume it can be extracted - [ ] Output validated before it reaches another system, a database or a user - [ ] Model and prompt versions pinned and recorded - [ ] Model supply chain reviewed: where the model and any third-party components come from - [ ] Sensitive information cannot be echoed back — outputs screened for credentials and personal data **Agent layer** (complete if the system takes actions, not just produces text) - [ ] Tools are narrow and specific, not general-purpose (`get_customer_orders`, not `run_query`) - [ ] Model cannot reach systems beyond its declared tools - [ ] Any destructive, financial or outbound action requires human approval - [ ] Runs with the requesting user's permissions, not an admin service account - [ ] No single component holds both broad read access and broad write access - [ ] Step, time and spend caps enforced per task - [ ] Stored memory and context can be inspected and cleared — poisoned context persists silently - [ ] Every tool call logged with actor, arguments and result **Governance** - [ ] Named owner accountable for the system's behaviour, and a person who can switch it off - [ ] Model inputs and outputs retained for audit, for a defined period - [ ] **EU AI Act Art. 50 transparency** (in force since 2 Aug 2026): users are told they are interacting with an AI system; generated content is labelled - [ ] Assessed whether the system falls in a **high-risk** category (employment, credit, insurance, education, critical infrastructure, biometrics) — obligations deferred to 2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I, but the assessment should be done now - [ ] Staff have an approved AI tool whose terms exclude training on your data ## 9. Incident readiness - [ ] Named incident decision-maker with authority to disconnect systems - [ ] Contact list stored somewhere that does not depend on these systems - [ ] Regulatory notification window known - [ ] Rollback tested, not assumed --- ## Sign-off | | Name | Date | |---|---|---| | Completed by | | | | Reviewed by | | | | Accepted risks approved by | | | **Accepted risks:** | # | Item not met | Why accepted | Accepted by | Revisit by | |---|---|---|---|---| | | | | | | --- ## Standards this is based on Checked 2026-08-04. Re-verify before relying on any date below. | Reference | Status | |---|---| | ISO/IEC 27001:2022 Annex A | Current | | NIST Cybersecurity Framework 2.0 | Current | | OWASP Top 10 for LLM Applications | 2025 edition | | OWASP Top 10 for Agentic Applications | 2026 edition, published Dec 2025 | | EU AI Act Art. 50 (transparency) | **Applies from 2 Aug 2026** | | EU AI Act high-risk (Annex III) | Deferred to 2 Dec 2027 by the Digital Omnibus, approved 29 Jun 2026 | | EU AI Act high-risk (Annex I, product-embedded) | Deferred to 2 Aug 2028 | | ISO/IEC 42001:2023 (AI management systems) | Current; increasingly requested in procurement | This checklist is a working aid, not a compliance certification, and not legal advice. Obligations depend on your role and jurisdiction.