Checklists
Run it the same way every time.
24 working checklists for servers, releases, email and domains, people and incident response. Tick items as you go, print a copy for the change record, and keep your place in the browser.
Servers
- Linux server baselineStandard settings for every new Linux server before it takes traffic or joins a cluster.27 items
- Windows Server baselineHardening and handover steps for a new Windows Server, domain-joined or standalone.24 items
- Laptop and endpoint baselineThe standard configuration for company laptops, whether Windows, macOS or Linux.14 items
- PostgreSQL server hardeningNetwork, authentication, roles and logging settings for a new or inherited PostgreSQL server.21 items
- Docker host hardeningSettings for a server that runs containers with Docker, including the mistakes that quietly expose services.19 items
- Firewall rule reviewA periodic review that removes forgotten rules and checks the ones that remain still match a real need.18 items
Delivery
- Before deploying a new serviceThe production-readiness gate for a new service, covering ownership, access, data, secrets and monitoring.27 items
- Release day: deploy and roll backWhat to confirm before, during and after a production release, including the exact moment to stop and roll back.21 items
- Kubernetes workload pre-deployChecks for a manifest or Helm chart before it reaches a shared cluster.18 items
- Web application security before launchApplication-level checks for login, sessions, authorization, input handling and headers.24 items
- CI/CD pipeline hardeningProtects the path from commit to production, which attackers prefer to the production systems themselves.19 items
Cloud
Email and domains
- Microsoft 365 tenant baselineThe identity, mail and sharing settings that decide whether one stolen password becomes a tenant takeover.23 items
- Email domain: SPF, DKIM and DMARCStops other people sending mail as you, and shows you who tries.17 items
- TLS certificates and DNS hygieneKeeps certificates from expiring in production and keeps old DNS records from becoming a takeover route.19 items
People
Response
- Leaked secret: what to do firstA password, API key or token has been committed, pasted or logged where it should not be.15 items
- Suspected phishing: for staff and for ITWhat a reporter should do, and what IT should check when someone clicked, opened or typed a password.18 items
- Ransomware: readiness and first actionsWhat to have in place before it happens, and what to do in the first hours if it does.20 items
- Lost or stolen deviceThe steps for a laptop or phone that has gone missing, for the owner and for IT.16 items
Operations
- Backup and restore testA backup you have not restored is a hope. Use this to run, record and learn from a restore test.16 items
- Vendor security onboardingQuestions and evidence to collect before a supplier gets data, access or a place in your critical path.20 items
- Security incident: the first hourA short list to work from while pressure is high. It does not replace your incident response plan.21 items
- Penetration test preparationGetting a test that finds real problems, runs safely, and ends in fixes instead of a report nobody reads.17 items
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.