Written security policies and procedures Multi-factor authentication and access controls Data encryption at rest Data encryption in transit (HTTPS, TLS) Regular backup and recovery procedures Incident response plan Vendor/third-party risk management Security awareness training program Security logging and monitoring Change management processes