Security

Accounts & access

• SSO, mandatory 2FA, password manager for shared secrets.
• Access reviews cadence.

Devices

• Disk encryption, screen lock, patching.

Data

• Classification, retention, where customer data may live.

Secrets

• No secrets in git. Where they are stored and rotated.

Incidents

• Report to the security contact immediately; follow the Operations incident process.