Penetration test (pentest)

A structured exercise that walks the system's actors, attack surface, risks, and controls. Day one of every DField project · before any code.

Security as a continuously-running CI step (SAST, DAST, SCA, IaC scan), not an annual project. Runs against every push; every sprint closes at least one security bug.

Two or more factors (TOTP, WebAuthn, biometric) beyond a password. Table-stakes in SaaS today · enterprise procurement disqualifies you without it.

A US audit framework for confidentiality, integrity, availability, and privacy controls. For SaaS, the Type II audit (6–12 months of observation) is the standard enterprise baseline.

International standard for Information Security Management Systems (ISMS). Often preferred in Europe instead of or alongside SOC 2. 3-year certification cycle.

A security model where every request is suspect (even from inside the network), and every action needs a separate authorisation check. The opposite of the classic perimeter model.