---
title: Security by Design Baseline
description: Establish practical security-by-design guidelines and baseline requirements for identity, network, workload, and data protection.
sidebar:
  label: Security by Design Baseline
  order: 12
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/security-by-design-baseline/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/security-by-design-baseline.mdx"
---

## Purpose

Security by Design means controls are defined as mandatory architecture and delivery requirements before workloads are integrated.

## Baseline guidelines

- **Least privilege by default**: Restrict permissions to explicit use cases and separate duties.
- **Secure-by-default setup**: Projects start with mandatory baseline settings and no insecure defaults.
- **Defense in depth**: Combine identity, network, workload, and data controls.
- **Encryption by default**: Require encryption in transit and at rest with clear key ownership.
- **Traceable control ownership**: Assign each control to an accountable owner and verification cadence.

## Recommended baseline requirements

- **Identity and access**: Central identity integration, role model, privileged access control, and periodic access reviews.
- **Network and connectivity**: Segmentation policy, ingress and egress controls, and approved hybrid paths.
- **Workload hardening**: Compute and runtime hardening baseline, patching policy, and restricted management access.
- **Secrets and keys**: Centralized secret handling and key life cycle governance.
- **Logging and evidence**: Mandatory onboarding to audit and operational telemetry.

## STACKIT references

- **Security hardening**: <LinkChip href="https://docs.stackit.cloud/products/security/security-hardening/security-in-networks/">Security In Networks</LinkChip> and <LinkChip href="https://docs.stackit.cloud/products/security/security-hardening/security-in-compute-engine/">Security In Compute Engine</LinkChip>
- **Secrets and key management**: <LinkChip href="https://docs.stackit.cloud/products/security/secrets-manager/basics/features-use-cases-and-service-plans/">Features Use Cases And Service Plans</LinkChip> and <LinkChip href="https://docs.stackit.cloud/products/security/kms/">KMS</LinkChip>
- **Audit and observability**: <LinkChip href="https://docs.stackit.cloud/platform/audit-log/">Audit Log</LinkChip> and <LinkChip href="https://docs.stackit.cloud/products/logging-and-monitoring/observability/">Observability</LinkChip>

## Anti-patterns to avoid

- **Checklist-only security by design**: Requirements are documented but not enforced technically.
- **Team-specific baseline variants**: Inconsistent control levels for similar workload classes.
- **Late hardening campaigns**: Baselines are applied after go-live instead of before onboarding.