Security Review
Scope and data classification
[Asset and trust boundary]
Threat model
[Threat and abuse case]
Identity and access
[Control and evidence]
Data protection
[Severity and exploitability]
Application controls
[Owner and due date]
Infrastructure and logging
[Release condition]
Third parties
[Third parties: decision, evidence, owner, constraints, and next action]
Findings and remediation
[Findings and remediation: decision, evidence, owner, constraints, and next action]
Sign-off
[Sign-off: decision, evidence, owner, constraints, and next action]
Measurement and Ownership
| Measure or deliverable | Baseline or input | Target or acceptance condition | Source | Owner | Review date |
|---|---|---|---|---|---|
| [Critical findings] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [High findings] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Patch SLA] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [MFA coverage] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Log retention] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |
| [Encryption coverage] | [Current state] | [Target or acceptance condition] | [System or evidence source] | [Accountable role] | [Date] |