Security, compliance, and data governance
Domain focus
Security, compliance, and data governance tests the controls that protect workspace data and satisfy auditors: SSO, SCIM, two-factor authentication, domain verification, guest restrictions, audit logs, export, retention, and contractual compliance. Questions often ask which control addresses a specific risk.
Core rules
- SAML SSO centralizes authentication through an identity provider. Enforcing SSO affects members; guest access must be controlled separately.
- SCIM automates user and group provisioning and deprovisioning. It reduces orphaned accounts but does not enforce MFA or define page permissions.
- Domain verification proves ownership of an email domain and supports controls such as restricting guests to approved domains.
- Audit logs record administrative and security-relevant events; they support investigation and evidence gathering but are not a substitute for real-time monitoring.
- Data governance includes workspace export, page version history, trash retention, ownership transfer, and deletion. Export is useful for portability but may not preserve every database relation or permission.
- Compliance depends on plan and contract: confirm certifications, data processing terms, and any HIPAA/BAA or residency commitments before promising them.
Worked example
A company wants to stop personal-email guests and require corporate login. Verify the company domain, restrict guest access to allowed domains, enable SAML SSO, enforce SSO for members, and use SCIM for provisioning. Reasoning: SSO controls authentication but does not block external guests; domain verification plus guest restrictions closes that gap; SCIM handles lifecycle but not access policy.
Traps
Believing SSO alone blocks guests; treating SCIM as MFA; assuming audit logs prevent incidents; promising HIPAA or residency without confirming plan and contract terms; assuming export captures all permissions and relations.