MFT security audit checklist

• Entra ID / OIDC SSO for operators
• Sign-in through single sign-on (Spot Suite)
• No shared service accounts for human access
• TLS 1.2+ on all protocol endpoints
• AES-256 encryption at rest documented
• Per-transfer audit log (user, IP, timestamp)
• Exportable audit packet for reviews
• Dedicated tenant isolation (no co-mingling)
• Retention and legal-hold policy per folder
• Revocation process when staff leave
• Cron / scheduled transfer support
• Data room with per-user roles for externals

Score: 0 / 12