IAM & least privilege
Administrative console access, API tokens, and deployment credentials.
Internal operational discipline — not an audited SOC report.
Practices
- Monthly access reviews: Reconcile administrator accounts, token scopes, and stale integrations.
- Scoped tokens: Least privilege by default for CI/CD and deployment credentials.
- Break-glass: Rare-use emergency accounts documented offline with post-use rotation.
A detailed IAM review checklist is available through procurement for qualified security reviews.