Implementation Checklist¶

Refer to the implementation checklist below to deploy and get started with the NHI Security Platform in your production environment. Setup starts with the database and basic settings, then user access, then connecting data sources and acting on what the platform finds. Deployments licensed for Certificate Management alone do not require the section marked NHI only (steps 12 to 20).

Base Setup¶

No.	Step	Notes
	Database
1	Choose the database	Use the bundled PostgreSQL database or Microsoft SQL Server. Both scale well. Decide before moving to production: switching later is not supported because data cannot be migrated.
	Mandatory settings
2	Apply the licence	Apply the registered licence key for either the complete NHI Security Platform or Certificate Management alone. The module then appears under Admin >> Non-Human Identities.
3	Move the installation encryption key	When you apply the licence, you are prompted to move the installation encryption key out of the installation folder, so the key and the encrypted data are not stored together. Follow the steps on screen.
4	Mail server settings	Enter your SMTP server details so the platform can send email notifications. Go to Admin >> General >> Mail Server Settings.
5	Proxy server settings	If a proxy server controls internet traffic, enter its details. The platform needs internet access to reach cloud and code repository APIs, certificate authorities and ACME providers. Go to Admin >> General >> Proxy Server Settings.
6	Server connectivity settings	Set the name and address that user machines use to reach the web console. Go to Admin >> General >> Securden Server Connectivity.

User Onboarding¶

No.	Step	Notes
7	Connect your directory	Import users and groups from Active Directory, Microsoft Entra ID or LDAP, keep them in sync, and let users sign in with their directory accounts. Go to Users >> Add.
8	Assign roles	Assign a predefined or custom role to each user. Create custom roles from Admin >> Customization >> Custom User Roles. Create one or two super administrators, then turn off further creation from Admin >> Customization >> Configurations.
9	Delete the default administrator account	The product ships with a local administrator account. Delete it. You may keep one other local account for emergencies, such as when the directory is down.
10	Enforce two-factor authentication	Require a second sign-in step for all users. Go to Admin >> Authentication >> Two Factor Authentication.
11	Set up single sign-on (SSO)	Connect a SAML identity provider such as Okta, Microsoft Entra ID, ADFS, OneLogin, PingIdentity or Google Workspace. Go to Admin >> Integrations >> SAML SSO.

Discovery, Identities and Secrets (NHI Only)¶

All paths below are under Admin >> Non-Human Identities.

No.	Step	Notes
	Prepare discovery
12	Review secret detection rules	The platform finds secrets by matching patterns. Review the built-in rules and add your own for organisation-specific secret formats, using PCRE-compatible regular expressions. Do this before the first scan. Go to Audits and Administration >> Settings >> Custom Detection Rules.
13	Exclude file types	Exclude file extensions that cannot hold secrets, such as archives, media and binaries. Scans run faster and return fewer false positives. Go to Audits and Administration >> Settings >> Exclude File Types.
	Connect and discover
14	Connect data sources	Add AWS, Microsoft Azure, GitHub, Bitbucket, IIS Manager or Linux devices. Start with one source to check results before adding the rest. Each setup screen has a help panel that explains its fields. Go to Integrations >> Data Sources.
15	Run the first discovery and review the dashboard	Discovery stays continuous once a source is connected. Re-sync a source any time from the Data Sources list. Review discovered identities, secrets, risk levels and environments on the Dashboard.
	Ownership and risk
16	Assign owners	Give each identity and secret a business owner and a technical owner. Owners are filled in automatically where the provider shares them; assign the rest by hand. The Identity Ownership Report lists identities with no business owner. Go to Identity Security >> Identities.
17	Review high-risk identities and secrets	Start with the High Risk NHI Report. Open an identity or secret to see its risk score, the specific findings behind it and the recommended next steps. Use Refresh assessment after you make changes.
	Act on findings
18	Rotate secrets	Rotate supported secrets directly at the source provider. The Secret Rotation Report lists secrets without rotation turned on.
19	Remediate credentials that cannot be rotated automatically	For credentials such as AWS IAM access keys, follow the staged remediation guide: clear the pre-change security checklist, then replace the credential in an order that keeps dependent workloads running. Go to Identity Security >> Secrets and choose Remediation.
20	Act on identities by type	Use the actions available for each identity type, such as managing permissions or editing repository settings. Go to Identity Security >> Identities and open the actions menu on a row.

Certificate Management¶

This section applies only when certificate management is used. All paths are under Admin >> Non-Human Identities >> Certificate Management.

No.	Step	Notes
21	Set up certificate authorities	Create a private root CA for internally signed certificates, connect the public CAs you buy from, and add ACME providers for automatic issuance and renewal. Go to Authorities.
22	Create CSR templates	Save reusable templates for certificate signing requests (CSRs), holding common details such as organisation, organisational unit and locality. Go to Certificate Signing Requests.
23	Bring in existing certificates	Add certificates manually or discover them from connected sources, so the inventory and expiry tracking are complete. Go to SSL/TLS Certificates >> Add Certificate.
24	Issue and renew certificates	Create a CSR and either self-sign it or submit it to a certificate authority. Certificates issued through ACME renew automatically.
25	Deploy certificates	Push certificates to Windows systems and the Microsoft Certificate Store. OpenSSH Server must be enabled on each target system. Go to SSL/TLS Certificates and choose Deploy Certificate.

Monitoring, High Availability and Maintenance¶

No.	Step	Notes
	Monitoring
26	Review the audit trail	The audit trail contains separate tabs for data sources, identities and secrets (NHI only) and for certificate management. Each entry records the user, IP address, time and stated reason, including each time a secret value is viewed. Go to Audits and Administration >> Audit.
27	Use the reports	NHI reports: Secret Rotation, High Risk NHI and Identity Ownership. Certificate reports: Expiring Certificates, Expired Certificates and Self-Signed Certificates. Export any report as PDF, CSV or XLSX. Go to Audits and Administration >> Reports.
28	Configure notifications	Choose which events send email notifications. Go to Admin >> Notifications >> Event Notifications.
29	Connect your SIEM	Forward audit events to your SIEM platform. Go to Admin >> Integrations.
	Security, high availability and maintenance
30	Restrict console access by IP address	Allow access to the web console only from specific IP addresses, and review the other security settings. Go to Admin >> Security.
31	Configure high availability	Deploy a secondary application server that takes over if the primary fails. You can add more application servers in other locations. With Microsoft SQL Server, you can use SQL Server clusters. Go to Admin >> High Availability.
32	Replace the self-signed certificate	The product ships with a self-signed certificate. Replace it with your CA-signed certificate and its private key.
33	Schedule database backups	Back up the full database to a remote network path, as often as every hour, and choose how many past copies to keep. Go to Admin >> High Availability >> Database Backup.
34	Keep the product up to date	Check for new releases and upgrade from Admin >> Product Upgrades.