Security checklist — [CLIENT] / [PROJECT]

Copy this file into the project folder at kickoff. Tick as you go, and where the project differs from baseline-runbook.md, write the delta and the reason. An untick with a reason is fine; an untick with no reason is not.

Tier: 1 / 2 / 2.5 / self-hosted Client contact (security questions): Personal data involved: yes / no — if yes, DPA signed on: [DATE] Started: [DATE] Delivered: [DATE] Handed over: [DATE]

Kickoff

• ☐Access requested is the narrowest that works — scopes listed in the access register
• ☐Data-flow diagram drawn and agreed with the client
• ☐Columns needed vs columns available compared; extras dropped
• ☐Personal data identified, and either removed, aggregated or pseudonymised
• ☐Regions confirmed EU/EEA — configured region string recorded below
• ☐Subprocessors listed in the Art. 30 register
• ☐DPA in place before any data moves (if personal data)
• ☐Incident plan filled in with the client's named contact and notify window
• ☐Dev/prod separation decided; test data is synthetic or a minimized sample

Build

• ☐Secrets in the vault, injected at runtime — nothing sensitive in the repo
• ☐Secret scanning on; git status clean of data files after a run
• ☐Dependencies pinned, lockfile committed, Dependabot on
• ☐Libraries bundled (tier 1) — no CDN, no outbound calls
• ☐All data values rendered as text; no innerHTML on a data value
• ☐Hostile-cell test row renders as visible text
• ☐TLS everywhere; no plain HTTP endpoint
• ☐Logging records events not payloads; no personal data in logs
• ☐Failure alert tested by triggering a real failure
• ☐Missed-run detection tested
• ☐Pre-publish sanity checks in place; job keeps last good output on failure

Before delivery

• ☐Totals reconciled against the source
• ☐Restore test done — date, what was restored, how long, what broke: _____
• ☐Open security advisories cleared, or listed below with a reason
• ☐Offline check (tier 1): opens and works with the network disabled
• ☐Zero outbound requests confirmed in devtools (tier 1)
• ☐Visible "data as of" timestamp present
• ☐Delivered version tagged in Git; pinned library versions recorded
• ☐Distribution channel agreed; client owns access control from here

Handover

• ☐templates/handover.md completed and countersigned
• ☐Credentials rotated
• ☐My access removed and verified (I tried, and I am locked out)
• ☐Access register has a revoked date on every row
• ☐Client data deleted from my machines and services — including backups
• ☐Docs delivered: README, runbook, what to do when an alert fires
• ☐Named owner for patching and monitoring after handover: _____

Recorded values

Deltas from the baseline

Open risks accepted by the client