Technical Security Plan

System / product: [Name of the system this plan covers] Owner: [Security or engineering owner] Version: [1.0] Last reviewed: [Date] Next review: [Date + 6 months]

---

1. Scope & overview

[One paragraph: what system this plan covers, what it does not cover, and who is responsible for it. Note any systems or data explicitly out of scope.]

2. Assets & data classification

[List the systems and data stores in scope and classify the data each one holds.]

Asset	Data it holds	Classification	Owner
[Application database]	[Customer records]	[Confidential]	[Owner]
[Object storage]	[Uploaded files]	[Confidential]	[Owner]
[Analytics store]	[Aggregated usage]	[Internal]	[Owner]

Classification levels: Public, Internal, Confidential, Regulated.

3. Access control & least privilege

• Identity: [How users and services authenticate — SSO provider, MFA requirement.]
• Roles: [The roles that exist and what each may access.]
• Least privilege: [How permissions are kept minimal and how default-deny is enforced.]
• Service-to-service: [How machine identities and API keys are scoped and stored.]
• Review cadence: [How often access is reviewed and how leavers are off-boarded.]

4. Data protection & encryption

• At rest: [Encryption for databases, backups, and object storage; key management approach.]
• In transit: [TLS version enforced; internal traffic encryption.]
• Secrets: [Where credentials and keys live and how they are rotated.]
• Backups: [How backups are encrypted, where they are stored, and retention.]

5. Network & infrastructure security

• Segmentation: [How production, staging, and development are isolated.]
• Ingress / egress: [Firewall and security-group rules; what is exposed publicly.]
• Hardening: [Baseline configuration, patched base images, disabled defaults.]

6. Monitoring & logging

• What is logged: [Authentication events, admin actions, data access, errors.]
• Where logs go: [Centralised log store; access controls on the logs themselves.]
• Retention: [How long logs are kept.]
• Alerting: [Which events page an on-call engineer and through which channel.]

7. Vulnerability management

• Dependency scanning: [Tooling and frequency.]
• Patch cadence: [Target time to patch critical, high, and routine findings.]
• Triage: [Who owns findings and how severity is decided.]

8. Incident response plan

Step	Action	Owner
Detect	[How incidents are identified]	[On-call]
Contain	[Immediate steps to limit damage]	[Incident lead]
Eradicate	[Remove the cause]	[Engineering]
Recover	[Restore service safely]	[Engineering]
Review	[Post-incident review and fixes]	[Owner]

Escalation contacts: [Names / roles and how to reach them out of hours.] Notification: [When and how affected customers or regulators are informed.]

9. Compliance mapping

[Map your controls to any framework you are working toward. Mark each honestly.]

Control	Framework reference	Status
[Access reviews]	[SOC 2 / ISO 27001 ref]	[Implemented / In progress]
[Encryption at rest]	[SOC 2 / ISO 27001 ref]	[Implemented / In progress]
[Incident response]	[SOC 2 / ISO 27001 ref]	[Implemented / In progress]