A security baseline for business software

Why a baseline

Most security incidents in business software don't come from sophisticated attacks. They come from missing basics: an account nobody disabled, a backup nobody tested, a library nobody updated. A baseline is the short list of basics that should never be missing.

Sign-in and access

• Users sign in with strong authentication; multi-factor is available, and required for admins.
• Single sign-on is supported where your organisation uses it.
• Permissions are set per role and per record, not just per screen.
• Accounts are disabled the day someone leaves.
• Admin access is limited to the people who genuinely need it, and reviewed regularly.

Data protection

• Data is encrypted in transit (HTTPS everywhere) and at rest.
• Encryption keys are managed and rotated, not hard-coded.
• Personal data is collected only where needed, and you know where it is stored.
• There is a written plan for responding to a personal data breach, as the DPDP Act expects.

Accountability

• An audit log records who did what, and when, and you can search it.
• Logs are retained for an agreed period and protected from editing.
• Every code change is reviewed by a second person before it reaches production.

Resilience

• Backups run automatically and are stored separately from production.
• A restore has been tested recently, and you know how long it takes.
• Development, staging and production environments are separate.
• Monitoring alerts a person when something breaks.

Maintenance

• Third-party libraries are scanned automatically for known vulnerabilities.
• There is a regular patch cadence, and it is actually kept.
• Someone is clearly responsible for the software's security after launch.