Last updated: 24 August 2026
1. Role-based access
User roles should be designed around job responsibilities, least-necessary access and separation of sensitive actions. Administrative access, edit rights, approvals and deletion permissions should be explicitly reviewed.
2. Audit and change history
Important records and decisions should retain appropriate ownership, status and history. The exact audit coverage, retention and reporting available must be verified against the deployed modules.
3. Data, hosting and environment controls
Hosting location, server configuration, database access, encryption, network controls, environment separation, monitoring and third-party services should be selected according to the deployment risk and commercial scope.
4. Backup and recovery
Backup frequency, retention, off-site copies, restoration testing, recovery objectives and responsible parties should be documented before go-live. A backup is useful only when restoration has been planned and tested.
5. Secure change and release practices
Configuration and development changes should be reviewed, tested and released through controlled environments. Credentials and production data should not be exposed in public code or unmanaged communication channels.
6. Shared responsibility
Security depends on the software, hosting provider, implementation team, administrators and end users. Password practices, account removal, device security, access reviews and incident communication require clear ownership.