Security Assessment Checklist
Interactive checklist for security reviews and compliance assessments
How to use this checklist
- Review each security control and mark its status
- Use filters to focus on specific priorities or frameworks
- Track your completion rate and identify gaps
- Export or document findings for compliance reporting
Assessment Progress
Filters
Authentication & Access Control
Multi-factor authentication (MFA) enforced
🔴Require MFA for all user accounts, especially administrative access
Strong password policy implemented
🟠Minimum length, complexity requirements, password rotation
Role-based access control (RBAC) configured
🟠Users have minimum necessary permissions based on roles
Session management secure
🔴Proper session timeouts, secure cookies, token rotation
Account lockout after failed attempts
🟡Prevent brute force attacks with account lockout policies
Data Protection
Data encrypted at rest
🔴All sensitive data encrypted using strong encryption (AES-256)
Data encrypted in transit
🔴TLS 1.2+ for all network communications
Sensitive data minimization
🟠Only collect and store necessary sensitive data
PII/PHI handling procedures
🔴Proper procedures for handling personally identifiable information
Data backup and recovery tested
🟠Regular backups with tested recovery procedures
Secure data deletion procedures
🟡Proper data sanitization when deleting sensitive information
Application Security
Input validation implemented
🔴All user inputs validated and sanitized
SQL injection prevention
🔴Parameterized queries, ORM usage, input sanitization
XSS (Cross-Site Scripting) prevention
🔴Output encoding, CSP headers, sanitization
CSRF protection implemented
🟠Anti-CSRF tokens for state-changing operations
Security headers configured
🟠CSP, X-Frame-Options, HSTS, X-Content-Type-Options
API rate limiting implemented
🟠Prevent abuse and DoS attacks on APIs
Dependency vulnerability scanning
🟠Regular scanning of third-party dependencies for vulnerabilities
Infrastructure Security
Firewall configured and maintained
🔴Network segmentation and firewall rules properly configured
Regular security patching
🔴OS and software patches applied within SLA timeframes
Intrusion detection/prevention system
🟠IDS/IPS monitoring for suspicious activity
DDoS protection configured
🟠Protection against distributed denial of service attacks
Secure container configuration
🟠Container images scanned, minimal base images, no root access
Secrets management system
🔴Proper storage and rotation of API keys, passwords, certificates
Monitoring & Logging
Security event logging enabled
🔴Log authentication, authorization, and security events
Log retention policy defined
🟡Appropriate retention periods for different log types
Security monitoring and alerting
🟠Real-time alerts for suspicious activities
Log integrity protection
🟠Logs protected from tampering and unauthorized access
Compliance & Governance
Security policy documented
🟠Written information security policy
Incident response plan
🔴Documented procedures for security incident response
Security awareness training
🟠Regular security training for all employees
Vendor security assessments
🟡Third-party vendor security reviews
Regular security audits
🟠Periodic internal and external security assessments
Penetration testing conducted
🟠Regular penetration testing by qualified professionals