Monthly website security checklist
Version: 1
Asset: __________
Period: __________
Coordinator: __________

Adapt this working template; it is not a security certificate or a completed result.
Monthly is a management cycle. Do not postpone an incident or urgent fix until the next review.
Agree the frequency of each task according to the system, change and business need.
Do not record secrets or unnecessary personal information.

Result states: Passed within reviewed scope | Failed | Not tested | Not applicable

MONTHLY-01 | Components and updates
Task: Review supported versions, relevant fixes and change acceptance
Frequency to agree: __________
Additional trigger: Component change or security advisory
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-02 | Staff and supplier access
Task: Review roles, ownership and temporary permissions
Frequency to agree: __________
Additional trigger: Staff or supplier departure or role change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-03 | Authentication and account recovery
Task: Review access and recovery arrangements without collecting codes
Frequency to agree: __________
Additional trigger: Lost access or authenticator/device change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-04 | Backups
Task: Review copy point, covered data, access and job exceptions
Frequency to agree: __________
Additional trigger: Backup failure or coverage change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-05 | Restore exercise
Task: Plan and perform an authorized isolated test at an agreed frequency
Frequency to agree: __________
Additional trigger: Storage, data structure or encryption change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-06 | Forms and orders
Task: Check the business route with synthetic data and controlled external actions
Frequency to agree: __________
Additional trigger: Plugin, recipient or integration change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-07 | Domain and DNS
Task: Review ownership, renewal and approved configuration changes
Frequency to agree: __________
Additional trigger: Provider move or DNS change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-08 | Business email
Task: Review relevant account and sending-system changes
Frequency to agree: __________
Additional trigger: New sender or account incident
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-09 | Integrations and secrets
Task: Review ownership and permissions without entering secret values
Frequency to agree: __________
Additional trigger: Exposure, supplier exit or interface change
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-10 | Alerts
Task: Review signals, coverage and responsible next action
Frequency to agree: __________
Additional trigger: Handle urgent events through the separate incident process
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-11 | Licenses and support
Task: Review validity, ownership and supplier dependencies
Frequency to agree: __________
Additional trigger: Provider move or end of support
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________

MONTHLY-12 | Open gaps and handover
Task: Assign open gaps, next owners and review dates
Frequency to agree: __________
Additional trigger: End of review cycle or engagement
Owner: __________ | Approver: __________
Status: Not tested
Checked at: __________
Evidence reference: __________
Limitations: __________
Next action: __________ | Due date: __________