---
title: Security pillar checklist
source_url: "https://architecture.arcgis.com/en/framework/architecture-pillars/security/checklist.html"
md_url: "https://architecture.arcgis.com/en/framework/architecture-pillars/security/checklist.md"
---
# Best practices for security

| Identifier | Best practice |
| -------- | ------- |
| S.1 | **Use your organization's enterprise identity provider** to allow user authentication to ArcGIS Online or ArcGIS Enterprise through either SAML or OpenID Connect. Follow your organization's guidance for the implementation of [multi-factor authentication](/en/framework/architecture-pillars/security/multi-factor-authentication.md) using this identity provider |
| S.2 | **Use automated patching** approaches to deploy operating system patches, and create a regular cadence for applying ArcGIS software patches to relevant systems. |
| S.3 | **Follow security recommendations** from the [ArcGIS Trust Center](https://trust.arcgis.com/en/), including the recommended and optional settings described in the [ArcGIS Enterprise Hardening Guide](https://www.esri.com/training/catalog/65afed44729953102f9cfd11/arcgis-enterprise-hardening-guide/). |
| S.4 | Work closely with **your organization's security team** or security professionals - both to understand and align to their guidelines, but also to create a pattern of regular review, critical discussion and proactive improvement. |
| S.5 | Use a **least privileges** approach when defining user roles and responsibilities -- opening up additional capabilities or sharing privileges for all users can lead to data leakage or corruption. |