[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571922-105":53,"doc-detail-571922-en":120},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":113,"head_meta":115,"extra_data":117,"updated_unix":119},105,"en","security-technical-it-checklist-stitch-version-11-security-checklist-and-requirements","Security Technical IT CHecklist (STITCH) - Version 1.1 - Security checklist and requirements","","Security Technical IT CHecklist (STITCH) is a simplified, measurable baseline for assessing whether an IT service or application is secure. The document defines eight STITCH items covering encryption in transit, user identity vetting with federated management, authorization via separation of duties and least privilege, secure session management, input/output normalization and validation, protection against leaking configuration information, and adequate logging and auditing. It also includes prerequisites such as GDPR compliance and organizational security governance, plus testing and references for each item.",{"@graph":63,"@context":112},[64,80,95],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/security-technical-it-checklist-stitch-version-11-security-checklist-and-requirements/571922/",4,{"url":78,"name":59,"@type":81,"author":82,"headline":59,"publisher":85,"fileFormat":88,"inLanguage":57,"description":61,"dateModified":89,"datePublished":89,"encodingFormat":88,"isAccessibleForFree":90,"interactionStatistic":91},"DigitalDocument",{"name":83,"@type":84},"Well Done","Person",{"url":68,"name":86,"@type":87},"DocShare","Organization","application/pdf","2026-10-13",true,{"@type":92,"interactionType":93,"userInteractionCount":4},"InteractionCounter",{"@type":94},"ViewAction",{"@type":96,"mainEntity":97},"FAQPage",[98,104,108],{"name":99,"@type":100,"acceptedAnswer":101},"What is STITCH and what is it used for?","Question",{"text":102,"@type":103},"STITCH is a simplified security checklist baseline with a limited number of measurable requirements. It helps Security Officers and security experts quickly assess whether a service or application is safe.","Answer",{"name":105,"@type":100,"acceptedAnswer":106},"What are the eight STITCH requirements?",{"text":107,"@type":103},"The eight items cover encryption of data in transit, vetted user identities with federated management, authorization based on separation of duties and least privilege, secure session management, normalized/validated/limited input and output data, preventing configuration information leaks, sufficient logging and auditing, and continuous maintenance and patch management.",{"name":109,"@type":100,"acceptedAnswer":110},"What prerequisites must be satisfied before applying STITCH?",{"text":111,"@type":103},"Prerequisites include legal and organizational conditions such as GDPR compliance, adherence to standards on a “comply or explain” list, consideration of architectural design principles, applying information security policy, classifying data, and avoiding shadow-IT by using existing organizational services.","https://schema.org",{"og:url":78,"og:type":114,"og:title":59,"og:site_name":86,"og:description":61},"article",{"robots":116,"canonical":78},"index,follow",{"doc_id":118,"site_id":56},571922,1791924461,{"code":4,"msg":5,"data":121},{"doc_id":118,"user_id":122,"nickname":83,"user_avatar":123,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":124,"file_id":125,"file_url":126,"file_type":127,"file_size":128,"view_count":4,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":8,"language":129,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":130,"faqs":131,"seo_title":132,"seo_description":61,"update_tm":119,"read_time":79},5909892210082,"https://ap-avatar.wpscdn.com/avatar/56001069da27c9f41e8?x-image-process=image/resize,m_fixed,w_180,h_180&k=1789614185077863061","Security Technical IT CHecklist (STITCH) Developed by the SCIRT community  \nAuthor(s): SCIRT STITCH Working Group  \nVersion: 1.1  \nDate: February 17, 2022  \nTable of Contents  \nIntroduction ........................................................................................................................... 3  \nSources ........................................................................................................................................3  \nPrerequisites................................................................................................................................3  \nSTITCH-1-All data in transit is encrypted ................................................................................4  \nSTITCH-2 The identity of users has been vetted and identities are managed federatively ..........5  \nSTITCH-3 Authorisation is based on separation of duties and least privilege .............................6  \nSTITCH-4 Secure session management is in place .....................................................................7  \nSTITCH-5 All input and output data is normalised, validated, and limited..................................8  \nSTITCH-6 Avoid leaking of configuration information ...............................................................9  \nSTITCH-7 Systems have sufficient logging and auditing capabilities......................................... 10  \nSTITCH-8 Continuous maintenance and patch management is in place ................................... 11  \nIntroduction  \nThere is an increasing need for software and services to comply with security requirements. With many different lists of requirements, which one do you choose? SCIRT, the community for cybersecurity, has developed a simplified checklist called Security Technical IT CHecklist (STITCH) .  \nThe idea behind STITCH is simple: a baseline with a limited number of requirements that are easy to measure. The results enable Security Officers and other security experts to quickly assess whether a service or an application is safe.  \nThe 8 STITCH items:  \n• STITCH-1: All data is in transit is encrypted  \n• STITCH-2: The identity of users has been vetted and identities are managed federatively  \n• STITCH-3: Authorisation is based on separation of duties and least privilege  \n• STITCH-4: Secure session management is in place  \n• STITCH-5: All input and output data is normalised, validated, and limited  \n• STITCH-6: Avoid leaking of configuration information  \n• STITCH-7: Systems have sufficient logging and auditing capabilities  \n• STITCH-8: Continuous maintenance and patch management is in place  \nSources  \n• ISO: International Organization for Standardization-[https://www.iso.org](https://www.iso.org)  \n• SSD: Grip op Secure Software Development-[https://www.cip-overheid.nl/wp](https://www.cip-overheid.nl/wp)content/uploads/2018/01/Grip-op-SSD-Beveiligingseisen-v2_0.pdf  \n• OWASP: Open Web Application Security Project-[https://www.owasp.org](https://www.owasp.org)  \n• RFC: Request For Comments-[https://www.ietf.org/standards/rfcs/](https://www.ietf.org/standards/rfcs/)  \n• W3C: World Wide Web Consortium (W3C) -[https://www.w3.org](https://www.w3.org)  \n• SSL Labs: SSL Labs server scan: -[https://www.ssllabs.com](https://www.ssllabs.com)  \n• [Securityheaders.io:](Securityheaders.io:) Security headers scan-[https://www.securityheaders.io](https://www.securityheaders.io)  \nPrerequisites  \nThe STITCH requirements assume a number of prerequisites to be met in areas of information security and privacy protection. These include:  \nLegal:  \n• Compliance with GDPR  \n• Use of standards that are on the \"Comply or explain\" list of the Dutch Standardisation Forum.  \nOrganisational:  \n• The organisation's architectural design principles should be taken into account.  \n• All data should be classified according to the existing guidelines.  \n• The organisation's information security policy should be applied.  \n• Shadow-IT, islands of automation, and ad-hoc","cbCainpphRPjoxNB","https://ap.wps.com/l/cbCainpphRPjoxNB","pdf",213530,"English","# Introduction\n# Sources\n# Prerequisites\n# STITCH-1 All data in transit is encrypted\n# STITCH-2 The identity of users has been vetted and identities are managed federatively\n# STITCH-3 Authorisation is based on separation of duties and least privilege\n# STITCH-4 Secure session management is in place\n# STITCH-5 All input and output data is normalised, validated, and limited\n# STITCH-6 Avoid leaking of configuration information\n# STITCH-7 Systems have sufficient logging and auditing capabilities\n# STITCH-8 Continuous maintenance and patch management is in place","[{\"question\":\"What is STITCH and what is it used for?\",\"answer\":\"STITCH is a simplified security checklist baseline with a limited number of measurable requirements. It helps Security Officers and security experts quickly assess whether a service or application is safe.\"},{\"question\":\"What are the eight STITCH requirements?\",\"answer\":\"The eight items cover encryption of data in transit, vetted user identities with federated management, authorization based on separation of duties and least privilege, secure session management, normalized/validated/limited input and output data, preventing configuration information leaks, sufficient logging and auditing, and continuous maintenance and patch management.\"},{\"question\":\"What prerequisites must be satisfied before applying STITCH?\",\"answer\":\"Prerequisites include legal and organizational conditions such as GDPR compliance, adherence to standards on a “comply or explain” list, consideration of architectural design principles, applying information security policy, classifying data, and avoiding shadow-IT by using existing organizational services.\"}]","Security Technical IT CHecklist (STITCH) - Version 1.1 - Security checklist and requirements | PDF"]