Security Technical IT CHecklist (STITCH) - Version 1.1 - Security checklist and requirements

Oct 13, 2026

Security Technical IT CHecklist (STITCH) is a simplified, measurable baseline for assessing whether an IT service or application is secure. The document defines eight STITCH items covering encryption in transit, user identity vetting with federated management, authorization via separation of duties and least privilege, secure session management, input/output normalization and validation, protection against leaking configuration information, and adequate logging and auditing. It also includes prerequisites such as GDPR compliance and organizational security governance, plus testing and references for each item.

LanguageEnglish

CategoryForms

FormatPDF

Pages11

Reading Time4 min

AccessFree to download

Introduction

Sources

Prerequisites

STITCH-1 All data in transit is encrypted

STITCH-2 The identity of users has been vetted and identities are managed federatively

STITCH-3 Authorisation is based on separation of duties and least privilege

STITCH-4 Secure session management is in place

STITCH-5 All input and output data is normalised, validated, and limited

STITCH-6 Avoid leaking of configuration information

STITCH-7 Systems have sufficient logging and auditing capabilities

STITCH-8 Continuous maintenance and patch management is in place

Security Technical IT CHecklist (STITCH) Developed by the SCIRT community Author(s): SCIRT STITCH Working Group Version: 1.1 Date: February 17, 2022 Table of Contents Introduction ........................................................................................................................... 3 Sources ........................................................................................................................................3 Prerequisites................................................................................................................................3 STITCH-1-All data in transit is encrypted ................................................................................4 STITCH-2 The identity of users has been vetted and identities are managed federatively ..........5 STITCH-3 Authorisation is based on separation of duties and least privilege .............................6 STITCH-4 Secure session management is in place .....................................................................7 STITCH-5 All input and output data is normalised, validated, and limited..................................8 STITCH-6 Avoid leaking of configuration information ...............................................................9 STITCH-7 Systems have sufficient logging and auditing capabilities......................................... 10 STITCH-8 Continuous maintenance and patch management is in place ................................... 11 Introduction There is an increasing need for software and services to comply with security requirements. With many different lists of requirements, which one do you choose? SCIRT, the community for cybersecurity, has developed a simplified checklist called Security Technical IT CHecklist (STITCH) . The idea behind STITCH is simple: a baseline with a limited number of requirements that are easy to measure. The results enable Security Officers and other security experts to quickly assess whether a service or an application is safe. The 8 STITCH items: • STITCH-1: All data is in transit is encrypted • STITCH-2: The identity of users has been vetted and identities are managed federatively • STITCH-3: Authorisation is based on separation of duties and least privilege • STITCH-4: Secure session management is in place • STITCH-5: All input and output data is normalised, validated, and limited • STITCH-6: Avoid leaking of configuration information • STITCH-7: Systems have sufficient logging and auditing capabilities • STITCH-8: Continuous maintenance and patch management is in place Sources • ISO: International Organization for Standardization-[https://www.iso.org](https://www.iso.org) • SSD: Grip op Secure Software Development-[https://www.cip-overheid.nl/wp](https://www.cip-overheid.nl/wp)content/uploads/2018/01/Grip-op-SSD-Beveiligingseisen-v2_0.pdf • OWASP: Open Web Application Security Project-[https://www.owasp.org](https://www.owasp.org) • RFC: Request For Comments-[https://www.ietf.org/standards/rfcs/](https://www.ietf.org/standards/rfcs/) • W3C: World Wide Web Consortium (W3C) -[https://www.w3.org](https://www.w3.org) • SSL Labs: SSL Labs server scan: -[https://www.ssllabs.com](https://www.ssllabs.com) • [Securityheaders.io:](Securityheaders.io:) Security headers scan-[https://www.securityheaders.io](https://www.securityheaders.io) Prerequisites The STITCH requirements assume a number of prerequisites to be met in areas of information security and privacy protection. These include: Legal: • Compliance with GDPR • Use of standards that are on the "Comply or explain" list of the Dutch Standardisation Forum. Organisational: • The organisation's architectural design principles should be taken into account. • All data should be classified according to the existing guidelines. • The organisation's information security policy should be applied. • Shadow-IT, islands of automation, and ad-hoc

FAQs

What is STITCH and what is it used for?

STITCH is a simplified security checklist baseline with a limited number of measurable requirements. It helps Security Officers and security experts quickly assess whether a service or application is safe.

What are the eight STITCH requirements?

The eight items cover encryption of data in transit, vetted user identities with federated management, authorization based on separation of duties and least privilege, secure session management, normalized/validated/limited input and output data, preventing configuration information leaks, sufficient logging and auditing, and continuous maintenance and patch management.

What prerequisites must be satisfied before applying STITCH?

Prerequisites include legal and organizational conditions such as GDPR compliance, adherence to standards on a “comply or explain” list, consideration of architectural design principles, applying information security policy, classifying data, and avoiding shadow-IT by using existing organizational services.

Oct 13, 2026

Upload by Well Done