Internal Tool Security Checklist for Small Business

An internal tool may not be public, but it still handles business, employee, customer, financial, or operational data. Security should be part of the tool's design, deployment, maintenance, and daily administration.

Use this checklist as a practical review. It is not a substitute for a specialized security assessment when the data or risk requires one.

Define what the tool protects

List records, files, credentials, customer data, financial data, business decisions, and integrations. Classify what would happen if data were read, changed, deleted, or unavailable.

Security priorities depend on the consequence. A simple scheduling dashboard and a tool containing identity or payment data need different controls.

Control users and roles

• Use unique user accounts instead of shared credentials.
• Apply least privilege to view, edit, approve, export, and administer.
• Review former employees, contractors, service accounts, and invitations.
• Require stronger authentication for sensitive access.
• Test direct URL, API, export, and record-level authorization.

Protect sessions and credentials

Use secure transport, appropriate cookie settings, expiration, logout, recovery, rate limits, and multi-factor authentication where appropriate. Store secrets outside source code and logs, rotate them with an owner, and separate environments.

Validate every input

Validate types, length, allowed values, file size, file type, identifiers, and state transitions on the server. Never trust a hidden field, browser value, or client-side permission check.

Escape output, use parameterized queries, protect state-changing requests, and keep error messages from revealing private records or credentials.

Handle files safely

Restrict file types and size, scan uploads, store outside public paths, require authorization to view, log access, and define retention and deletion. The secure file upload guide covers this workflow in more detail.

Protect integrations

Document API scopes, provider accounts, rate limits, webhooks, retries, and data fields. Do not expose provider credentials in the browser. Alert on failed jobs, unusual volume, expired credentials, and schema changes.

Log meaningful activity

Record sign-in failures, permission changes, sensitive views, exports, approvals, deletes, key state changes, and administrative actions. Avoid logging passwords, tokens, full payment details, or unnecessary personal data.

Keep log access restricted, retain it for a defined period, and make timestamps and user identity useful for investigation.

Back up and recover

Back up data, configuration, files, and deployment information. Test restore and document who can perform it. Decide what the business does manually when the tool is unavailable.

Maintain and review

Track dependencies, security advisories, certificates, users, provider changes, backups, vulnerabilities, and incidents. Review the tool after a workflow or integration change.

Security is not finished at launch. The custom software maintenance checklist covers the recurring work that keeps controls effective.