Security Checklist

Works alongside: Release Checklist · QA Checklist · Incident Report

The template

Instruction lines are marked with > — delete them once the document is filled in.

System / release: _______________ Date: _______________ Completed by: _______________ Reviewed by: _______________ (not the author)

Ordered by what actually gets exploited, not by framework section number. Mark N/A with a reason — a blank is not an answer.

1. Identity and access#

• [ ] Multi-factor authentication enforced for all administrative access
• [ ] No shared accounts; every action attributable to a person
• [ ] Least privilege applied — reviewed, not assumed
• [ ] Service accounts scoped to one purpose, not reused
• [ ] Access review completed within the last quarter
• [ ] Leaver process removes access same-day
• [ ] Default credentials changed everywhere
• [ ] Session timeout and invalidation on logout verified

2. Secrets#

• [ ] No credentials, keys or tokens in source control (history checked, not just HEAD)
• [ ] Secrets held in a secret store, not environment files committed by accident
• [ ] Rotation possible without downtime, and someone knows how
• [ ] Secrets not written to logs, error messages or crash dumps

3. Data#

• [ ] Personal data identified and its lawful basis recorded
• [ ] Encrypted in transit (TLS 1.2 minimum; 1.3 preferred)
• [ ] Encrypted at rest where the platform supports it
• [ ] Retention period defined and enforced, not aspirational
• [ ] Test environments use masked or synthetic data
• [ ] Backups tested by restoring, within the last quarter
• [ ] At least one backup copy offline or immutable

4. Input and output#

• [ ] All input validated server-side (client-side validation is UX, not security)
• [ ] Parameterised queries throughout — no string-built SQL
• [ ] Output encoded for its context
• [ ] File uploads: type, size and content checked; stored outside the web root
• [ ] Error messages reveal nothing about internals to end users

5. Interfaces and dependencies#

• [ ] Every external interface authenticated and rate-limited
• [ ] Dependencies scanned for known vulnerabilities; criticals resolved
• [ ] Dependency versions pinned
• [ ] Third-party services reviewed for what data they receive
• [ ] Unused endpoints, ports and services removed

6. Configuration#

• [ ] Debug modes and verbose errors disabled in production
• [ ] Security headers present: HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• [ ] Directory listing disabled
• [ ] Administrative interfaces not reachable from the public internet, or MFA-gated
• [ ] Non-existent pages return a real 404, not a soft 200

7. Logging and detection#

• [ ] Authentication successes and failures logged
• [ ] Privileged actions logged with actor, time and before/after
• [ ] Logs stored where an attacker with system access cannot edit them
• [ ] Logs contain no passwords, tokens or full personal records
• [ ] Someone is responsible for looking at them

8. AI-specific surface#

Complete this section if any component uses a language model. Aligned to the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026).

Model layer

• [ ] Prompt injection considered: what happens if retrieved or user content contains instructions?
• [ ] Untrusted content clearly delimited and never concatenated into the instruction block
• [ ] System prompt treated as non-secret — assume it can be extracted
• [ ] Output validated before it reaches another system, a database or a user
• [ ] Model and prompt versions pinned and recorded
• [ ] Model supply chain reviewed: where the model and any third-party components come from
• [ ] Sensitive information cannot be echoed back — outputs screened for credentials and personal data

Agent layer (complete if the system takes actions, not just produces text)

• [ ] Tools are narrow and specific, not general-purpose (get_customer_orders, not run_query)
• [ ] Model cannot reach systems beyond its declared tools
• [ ] Any destructive, financial or outbound action requires human approval
• [ ] Runs with the requesting user's permissions, not an admin service account
• [ ] No single component holds both broad read access and broad write access
• [ ] Step, time and spend caps enforced per task
• [ ] Stored memory and context can be inspected and cleared — poisoned context persists silently
• [ ] Every tool call logged with actor, arguments and result

Governance

• [ ] Named owner accountable for the system's behaviour, and a person who can switch it off
• [ ] Model inputs and outputs retained for audit, for a defined period
• [ ] EU AI Act Art. 50 transparency (in force since 2 Aug 2026): users are told they are interacting with an AI system; generated content is labelled
• [ ] Assessed whether the system falls in a high-risk category (employment, credit, insurance, education, critical infrastructure, biometrics) — obligations deferred to 2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I, but the assessment should be done now
• [ ] Staff have an approved AI tool whose terms exclude training on your data

9. Incident readiness#

• [ ] Named incident decision-maker with authority to disconnect systems
• [ ] Contact list stored somewhere that does not depend on these systems
• [ ] Regulatory notification window known
• [ ] Rollback tested, not assumed

Sign-off#

Accepted risks:

Standards this is based on#

Checked 2026-08-04. Re-verify before relying on any date below.

This checklist is a working aid, not a compliance certification, and not legal advice. Obligations depend on your role and jurisdiction.