SFC: Workspace Security | Security Alliance — Security Checklist

Is there a clearly designated person or team accountable for workspace security?

Do you maintain a workspace security policy that is accessible and understood by all personnel?

Do you maintain an inventory of organizational devices and accounts with defined ownership?

Do you classify systems and data by sensitivity to determine appropriate security controls?

Do you define and enforce security standards for organizational devices?

Do you have procedures for device loss, theft, and secure decommissioning?

Do you deploy and monitor endpoint protection on organizational devices?

Do you maintain physical security requirements for workspaces and travel?

Do you have procedures for provisioning, modifying, and revoking user accounts?

Do you enforce multi-factor authentication across organizational accounts?

Do you maintain security standards for all organizational accounts, including enterprise platforms and external services?

Do you enforce credential management standards, including secure storage and individual accountability?

Do you conduct periodic access reviews and promptly adjust permissions when roles change?

Do you evaluate and approve software, extensions, and tools before organizational use?

Do you secure source code repositories against unauthorized access and credential exposure?

Do you enforce secure network access for organizational systems?

Do you secure organizational communications and verify identity for sensitive interactions?

Do you verify employee identity and provide security onboarding before granting system access?

Do you have comprehensive offboarding procedures for departing personnel?

Do you maintain a security awareness program with regular training and testing?

Do you detect and respond to workspace security incidents?

Do you assess insider threat risks and enforce least-privilege access for each role?

Do you manage third-party access with time-limited, purpose-specific permissions?