{
  "title": "Monthly website security checklist",
  "version": 1,
  "asset": "",
  "period": "",
  "coordinator": "",
  "instructions": [
    "Adapt this working template; it is not a security certificate or a completed result.",
    "Monthly is a management cycle. Do not postpone an incident or urgent fix until the next review.",
    "Agree the frequency of each task according to the system, change and business need.",
    "Do not record secrets or unnecessary personal information."
  ],
  "allowedStatuses": ["Passed within reviewed scope", "Failed", "Not tested", "Not applicable"],
  "tasks": [
    {
      "id": "MONTHLY-01",
      "area": "Components and updates",
      "task": "Review supported versions, relevant fixes and change acceptance",
      "frequencyToAgree": "",
      "additionalTrigger": "Component change or security advisory",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-02",
      "area": "Staff and supplier access",
      "task": "Review roles, ownership and temporary permissions",
      "frequencyToAgree": "",
      "additionalTrigger": "Staff or supplier departure or role change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-03",
      "area": "Authentication and account recovery",
      "task": "Review access and recovery arrangements without collecting codes",
      "frequencyToAgree": "",
      "additionalTrigger": "Lost access or authenticator/device change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-04",
      "area": "Backups",
      "task": "Review copy point, covered data, access and job exceptions",
      "frequencyToAgree": "",
      "additionalTrigger": "Backup failure or coverage change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-05",
      "area": "Restore exercise",
      "task": "Plan and perform an authorized isolated test at an agreed frequency",
      "frequencyToAgree": "",
      "additionalTrigger": "Storage, data structure or encryption change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-06",
      "area": "Forms and orders",
      "task": "Check the business route with synthetic data and controlled external actions",
      "frequencyToAgree": "",
      "additionalTrigger": "Plugin, recipient or integration change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-07",
      "area": "Domain and DNS",
      "task": "Review ownership, renewal and approved configuration changes",
      "frequencyToAgree": "",
      "additionalTrigger": "Provider move or DNS change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-08",
      "area": "Business email",
      "task": "Review relevant account and sending-system changes",
      "frequencyToAgree": "",
      "additionalTrigger": "New sender or account incident",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-09",
      "area": "Integrations and secrets",
      "task": "Review ownership and permissions without entering secret values",
      "frequencyToAgree": "",
      "additionalTrigger": "Exposure, supplier exit or interface change",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-10",
      "area": "Alerts",
      "task": "Review signals, coverage and responsible next action",
      "frequencyToAgree": "",
      "additionalTrigger": "Handle urgent events through the separate incident process",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-11",
      "area": "Licenses and support",
      "task": "Review validity, ownership and supplier dependencies",
      "frequencyToAgree": "",
      "additionalTrigger": "Provider move or end of support",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    },
    {
      "id": "MONTHLY-12",
      "area": "Open gaps and handover",
      "task": "Assign open gaps, next owners and review dates",
      "frequencyToAgree": "",
      "additionalTrigger": "End of review cycle or engagement",
      "owner": "",
      "approver": "",
      "status": "Not tested",
      "checkedAt": "",
      "evidenceReference": "",
      "limitations": "",
      "nextAction": "",
      "dueDate": ""
    }
  ]
}