> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/agile-delivery-playbook/operating-controls/security-data-and-assurance.md).

# Security, Data and Assurance

### Overview

Security, data protection and assurance must be built into delivery from the beginning. They are not final-stage activities.

### Security by Phase

### Discovery

Focus on identifying security, data and assurance constraints.

Activities:

* identify data types
* identify likely access requirements
* identify customer security policies
* identify hosting and integration constraints
* identify assurance obligations

### Alpha

Focus on testing security assumptions.

Activities:

* explore data flow options
* assess integration risks
* identify threat areas
* test feasibility of secure approaches
* avoid unnecessary real sensitive data

### Beta

Focus on implementing secure controls and producing evidence.

Activities:

* secure coding
* code review
* dependency scanning
* vulnerability management
* access control implementation
* test evidence
* security review

### Live

Focus on monitoring, patching, incident response and continuous assurance.

Activities:

* vulnerability monitoring
* access review
* incident management
* logging and monitoring
* backup and recovery review
* security reporting

### Retirement

Focus on secure closure.

Activities:

* access removal
* data deletion or retention
* archive protection
* integration closure
* credential removal
* decommissioning evidence

### Data Classification

Projects should classify data before handling it.

Possible classifications:

* public
* internal
* confidential
* customer confidential
* personal data
* sensitive operational data
* special category personal data where applicable

### Access Control

Access should follow:

* least privilege
* named accounts
* multi-factor authentication where required
* role-based access
* time-bound access
* regular review
* prompt removal

### Assurance Evidence

Assurance evidence may include:

* security requirements
* architecture decision records
* data flow maps
* access control matrix
* vulnerability scan results
* penetration test reports where applicable
* remediation records
* risk acceptance records
* release approvals
* operational readiness checklist

### Security Risk Acceptance

Security risks must not be accepted informally.

A risk acceptance should record:

* risk description
* impact
* likelihood
* mitigation
* residual risk
* accepting authority
* review date
* expiry or condition

### Minimum Security Questions

Every project should ask:

* What data will we handle?
* Who needs access?
* Where will data be stored?
* How will data move between systems?
* What logging is required?
* What security controls are mandatory?
* What evidence will the customer need?
* What happens if there is an incident?