A small application can process confidential information or support important decisions. Grassroot IT therefore examines necessary information, permitted use and the consequences of incorrect or missing results. File size alone does not determine protection needs.
Examine concrete events and possible consequences
Consider this scenario: an import might fail to detect a changed column order, assign amounts incorrectly and produce erroneous payment proposals. Derive input checks and reconciliation from the actual process.
Assign permissions so users can perform their intended tasks. Manage credentials through approved procedures. Before sharing a workbook or database file, examine which information and connections become accessible.
Carry protection through the lifecycle
Testing includes relevant error cases. Organise changes and recovery, and address incidents. Remove unneeded permissions and connections during replacement.
The Secure Software Development Framework (SSDF), version 1.1 describes general secure development practices. Required safeguards follow from actual use and applicable requirements. Data protection adds the perspective of personal data processing.