Passwords & secrets

• Passwords are minimum 16 characters. Use a password manager - never reuse work passwords.
• Secrets and API keys live in the managed vault; never paste them into tickets or chat.
• Rotate any credential you suspect is exposed and report it immediately.

MFA & passkeys

• A passkey is required for administrators and approvers.
• Keep one TOTP fallback and store backup codes offline.
• If you lose your device: use a backup code, then re-enrol and ask your admin to revoke the lost factor.

Sessions

• Sessions idle-timeout per policy; sensitive actions trigger step-up MFA.
• Review Settings -> Security -> Active sessions and revoke anything unfamiliar.
• The platform flags impossible travel (>500 km/h) and new devices - expected protection.

Devices

Safe behaviour (the human firewall)

• Verify unexpected requests out-of-band (call the person on a known number).
• Treat urgency + secrecy + payment/crypto as a fraud triad - stop and report.
• Lock your screen when away; never leave a logged-in session unattended.
• Report lost/stolen devices within 1 hour so credentials and sessions can be revoked.

Phishing-resistant by default: prefer passkeys and passwordless; they defeat credential-phishing kits.