Identity and privilege
Use named accounts, least privilege and stronger controls for administrative access. Review privileged roles regularly.
Secrets
Keep API keys and administrative credentials out of browser code, repositories and shared documents; rotate them through controlled processes.
Segmentation
Separate public web applications from sensitive administrative and backend services.
Logging
Record authentication, privileged changes, integration failures and security-relevant events with protected timestamps.
Change control
Require review and rollback plans for high-impact production configuration.
Backups and recovery
Protect backups from the same failure domain as production and test restoration.
Third parties
Inventory external dependencies, credentials, data flows and escalation contacts so vendor incidents can be contained and investigated.