# Crypto OpSec readiness brief

Canonical: https://www.web3sec.news/guides/opsec
Service: https://www.web3sec.news/services/crypto-operational-security

Use this to prepare a scoped review, not to score or certify an organization. Assign owners and store supporting evidence in your approved private system. Never put seed phrases, private keys, recovery codes or production credentials in this brief or a contact message. Use test credentials and controlled exercises.

## Owner, control and evidence

For each check record: owner; asset or dependency; evidence location; unresolved action; retest date.

- [ ] Name an owner for each critical asset and record who can change its permissions, recover access or authorize an emergency action.
- [ ] Inventory treasury and protocol-administration wallets, owners, thresholds and enabled modules or delegates; assign independent review of consequential transaction details.
- [ ] Separate signing from routine browsing and development where practical; document approved devices, software and a lost-device procedure without placing recovery secrets in the inventory.
- [ ] Protect privileged identities with phishing-resistant MFA where supported, review recovery dependencies and test an approved fallback using a synthetic account or controlled exercise.
- [ ] Reconcile joiner, role-change and departure records with actual identity-provider, GitHub, cloud, registrar and wallet authority; include service tokens and active sessions.
- [ ] Confirm domain ownership, renewal and recovery contacts, registrar protections and available registry locks; review who can change DNS, email routing and the public frontend.
- [ ] Trace an approved source change through CI/CD to deployment; review dependency execution, workflow permissions, release approvals and who can override them.
- [ ] Assign secret owners and consumers, narrow access and retention, and demonstrate revocation or expiry with a test credential rather than exposing a production secret.
- [ ] Send representative privileged-change and security alerts to an accountable recipient; record delivery, useful context, log retention and the escalation path when the first contact is unavailable.
- [ ] Rehearse one realistic failure, such as an unavailable signer or compromised deploy account; record decisions, recovery prerequisites, verification evidence and a date to retest unresolved actions.

## References

- [SEAL: Multisig Security Framework](https://frameworks.securityalliance.org/multisig-for-protocols/overview/)
- [SEAL: Domain & DNS Security framework, authored by Raiders](https://frameworks.securityalliance.org/infrastructure/domain-and-dns-security/overview/)
- [OWASP: Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
- [SEAL: Certification Framework and accredited certification process](https://frameworks.securityalliance.org/certs/overview/)

This brief does not establish SEAL certification or incident-response availability.