A reviewed security checklist with named owners for credentials, access, updates, logs, incident response, and device retirement.
Give every actor a controlled identity
People, devices, gateways, and server integrations should not share one unrestricted credential. Issue the narrowest identity the actor needs and record its owner and lifecycle.
- Separate human sessions from device and service credentials.
- Separate development, pilot, and production environments.
- Use least privilege for actions that can affect equipment or customers.
- Define issue, rotation, revocation, and recovery procedures.
Protect data and commands in transit
Use encrypted transport for device and API traffic, validate the server identity, and never disable certificate checks to make commissioning easier. Sensitive commands require explicit authorisation, audit history, and confirmation from the field where possible.
- 01Validate the TLS certificate chain and device clock assumptions.
- 02Keep credentials out of logs, URLs, repositories, and screenshots.
- 03Make command retries idempotent and record the initiating user or service.
- 04Test expired credentials and rejected commands before production rollout.
Test the security lifecycle
Commissioning is not the end of trust management. Plan how devices receive updates, how access is reviewed, how suspicious activity is investigated, and how a unit is transferred or retired.
- Review user and integration access on a fixed schedule.
- Monitor authentication failures, unusual commands, and configuration change.
- Stage updates, verify signatures, observe health, and preserve a recovery path.
- Revoke credentials and remove customer data when equipment is decommissioned.
Completion check: the team has tested loss of network, expired credentials, failed updates, access removal, and the incident escalation path.