9. Security

Security is part of system design, not a final review step. Zero Trust guidance says network location alone should not create implicit trust. Authentication establishes identity; authorization decides what that identity can do. Least privilege, data protection, secure secret handling, input validation, and security telemetry should be built into the architecture.

Evidence: S27, S28, S29

Checklist

• Assets and sensitive data are identified and classified.

• Trust boundaries are shown in the architecture.

• Authentication method is defined for users, services, and automation.

• Authorization is enforced at the resource/action level, not only at the UI.

• Least privilege is applied to identities and service accounts.

• Secrets are stored outside source code and rotated through a managed process.

• Encryption in transit is required where appropriate.

• Encryption at rest meets the data classification/compliance requirement.

• Inputs are validated at trust boundaries.

• Network exposure is minimized.

• Administrative/control-plane access is tightly restricted and auditable.

• Security-relevant events are logged and monitored.

• Dependency and patch management are part of the operational design.

• Threat modeling/security review is planned for material risks.

Evidence: S27, S28, S29