Software security checklist: 30 checks you can hold your supplier to

One Monday morning nobody can log in to the customer portal. It turns out that a former intern still had admin access with the password “Summer2023!”, and that the same password had leaked from a completely different service. Nobody had turned on two-factor authentication, and the most recent backup that could actually be restored was three weeks old. This was a very ordinary attack. It is the kind of incident we hear about most often, and it could have been prevented with five of the 30 checks below.

The checklist is written for owners and managers who buy or own software: website, webshop, customer portal, app or internal system. All you need is to be able to ask the questions and expect clear answers. If you process particularly sensitive data or are covered by sector rules, supplement it with a security adviser.

Why do security holes hit small companies too?

Because most attacks are automated. Bots scan the entire internet for known holes in outdated plugins, for login pages where leaked passwords can be tried, and for open databases and forgotten test environments. They look for weaknesses and pay no attention to company size. A small webshop with an outdated plugin is therefore just as obvious a target as a large one. The good news is that the same automated attacks are stopped by basic hygiene: updates, strong logins and limited access.

Which security checks concern login and access?

Access is the area where you can do the most yourself, because it is as much about people and routines as about code. The six checks below should be in place in every system that holds customer data.

1. Two-factor authentication is switched on for every admin and every employee with access to customer data.
2. Login limits the number of attempts, so bots cannot try thousands of passwords.
3. Passwords are stored with a modern hashing algorithm and never in plain text.
4. Every employee has their own user. Nobody shares logins such as “admin” or “office”.
5. Roles grant least privilege: support can see customers but cannot change prices or export everything.
6. There is a fixed routine for removing access on the day an employee or supplier leaves.

If you have many users, login with MitID or with the company’s Microsoft or Google account can be both safer and easier. Staff avoid yet another password, and when they leave and lose their work account, they lose access to your system too. We describe how MitID fits into a custom solution in our article on MitID integration in your own app.

How do you keep software updated and secure?

Modern software consists of hundreds of open-source packages, and holes are found in them all the time. That is normal and a sign the ecosystem works. The danger comes when nobody updates. A website that has not been touched for two years almost always has known vulnerabilities. Updates must therefore be a fixed, planned part of operations, independent of anyone remembering.

1. Dependencies are scanned automatically for known vulnerabilities, and critical findings are fixed within days.
2. Framework, server and database are updated on a fixed schedule, at least monthly for security patches.
3. Updates are tested in a staging environment before going to production.
4. Unused plugins, packages and features are removed, so there is less to attack.
5. The system runs on a language and framework version that still receives security updates.

The last check is often the most expensive. If your system runs on a version that is no longer supported, there are no updates to install, and diligence does not help. This is technical debt, and the fix is a planned upgrade or a modernisation of the legacy system.

How do you protect data and backups?

1. All traffic is encrypted with HTTPS, and old, insecure encryption is disabled.
2. Databases and files are encrypted at rest.
3. Automatic backups are taken at least daily and stored separately from production.
4. At least one backup cannot be altered or deleted by anyone with production access.
5. Restores are tested regularly, and you know the real time it takes to get back up and running.

Ask your supplier for two numbers: how much data you can lose at most (typically the time since the last backup), and how long it takes to get back up. If they cannot answer, the backup has not been tested. Where backups and data are physically stored also matters for GDPR, which we cover in our guide to hosting data in the EU.

What is OWASP, and which coding flaws should you know?

OWASP is an international non-profit that publishes, among other things, the OWASP Top 10, a list of the most critical security risks in web applications. The list is the shared language between developers, testers and customers. It is enough to ask your supplier to confirm that the seven checks below are handled. They cover the flaws that most often lead to data leaks in business software.

1. Access control is checked on the server on every request, so a user cannot see another customer’s data by changing an ID in the URL.
2. Database queries are parameterised, so input cannot alter the query (SQL injection).
3. User input is validated and output is escaped, so scripts cannot be injected (XSS).
4. Forms and actions are protected against forged requests from other sites (CSRF).
5. Secret keys and passwords for databases and APIs live outside the code in a secure environment.
6. Security headers such as HSTS and Content Security Policy are configured.
7. Uploaded files are checked for type and size and stored separately from the code.

If you have a prototype built with Lovable, Bolt, Cursor or similar that real customers are going to use, read our guide on going from AI prototype to production. It covers exactly the points that are typically missing.

Monitoring, suppliers and incident response: the last 7 checks

1. Uptime, error rates and unusual activity are monitored, and alerts go to a named recipient.
2. Logs of logins, admin actions and errors are stored outside the system and for a fixed period.
3. Test environments use test or anonymised data, never a copy of production.
4. There is a written plan for what happens in an incident: who does what, and who contacts whom.
5. You have data processing agreements and know which subcontractors can access your data.
6. You own the domain, hosting accounts and code yourselves, so you are not locked in if a supplier disappears.
7. Security is reviewed at least once a year together with the supplier.

With the 6 checks on login, 5 on updates, 5 on data, 7 on code and these 7, you have all 30. Ownership in check 29 is often overlooked, and it is decisive in a crisis. Read more in our guide who owns the code.

What does NIS2 mean for your company?

NIS2 is an EU directive on cybersecurity that Denmark has implemented in national law. It sets requirements for risk management, security measures, management accountability and incident reporting. It applies mainly to medium-sized and large companies in specific sectors such as energy, transport, health, digital infrastructure, certain kinds of manufacturing and public administration. Most small companies are not directly covered. Many will still feel it indirectly, because covered customers impose requirements on their suppliers through contracts. Whether you are covered depends on sector and size, so check the Danish authorities’ guidance or ask an adviser. We do not go into deadlines and sanctions here.

What does security cost in a software solution?

Most security is built into good development and good operations. A common rule of thumb is that maintenance costs 15–20 % of the build price per year, and security updates, monitoring and backups make up a significant share of that. Read more about the levels in our guide to website maintenance costs. Take an example: a company with 15 employees has a customer portal that cost DKK 150,000. Running it typically costs DKK 22,500–30,000 a year, a penetration test before launch perhaps DKK 30,000–50,000, and a yearly review a day or two. Compared with the cost of a week without access to the portal, that is cheap.

With us, the fixed monthly price covers hosting, maintenance, updates, support, security and backups, and you own the code and the data. If you want your current solution reviewed against the 30 checks, or need something new built, send a short description and you will have a fixed-price proposal within 24 hours.