Can every privileged action be explained and reviewed?
List roles, resources, and allowed actions, then test the matrix with representative accounts. Pay particular attention to user administration, exports, bulk changes, approval overrides, secret access, configuration, and actions performed through APIs rather than the interface.
Administrative access should be individually attributable. Shared accounts remove accountability, while unused accounts and standing privileges increase exposure after staff or supplier responsibilities change.
Verify authorisation at the service layer. Hiding a button is not access control if the underlying endpoint still accepts an unauthorised request.
Do you know which sensitive data exists and why it is retained?
Create a data inventory covering collection, purpose, source, storage, access, transfer, retention, deletion, backup, and third-party processing. Include logs and exports because they often contain the same sensitive fields as the main database.
Collect and retain only what the workflow and applicable obligations require. Test that deletion or anonymisation also reaches search indexes, object storage, analytics, queued events, and other copies within the agreed policy.
Protect secrets and sensitive records in transit and at rest, but do not treat encryption as a replacement for access control, key management, audit, and breach detection.
Has the team restored the service, not just created a backup?
A backup is useful only when it can be located, decrypted, restored, and reconciled within the required time. Record recovery-time and recovery-point expectations in business terms before choosing technology.
Exercise a restore in an isolated environment. Verify application configuration, identity, object storage, queues, scheduled jobs, DNS, certificates, and third-party dependencies as well as the primary database.
Before launch, name the incident lead, technical responders, decision authority, communication owner, evidence-preservation steps, and conditions for rollback or service shutdown.