Controls

• Access: least privilege, MFA, session limits
• Data at rest: encrypted storage
• In transit: TLS 1.2+
• Document control: versioning, checksums
• Backups & retention: policy‑defined
• Incident response: playbooks and RACI
• Vendor risk: DPAs and review