Maintenance and change logs should be kept religiously. Programmers must test code with real-world data in an isolated environment. Security changes have to go through the proper channels. The proper channels have to be lubricated with designated backups and as much automation as is humanly possible. Everything worthy of an audit trail has to be captured.
Audit logs have to be checked, maintained and archived.
The foundation has to be deep and wide enough to support the bricks and the bricks have to be laid straight or the whole thing will tumble down. Security levels One way to establish a measurement for security needs is to determine security levels. This is where the gray area of security gets black and white. If it did, the highest level of security could be implemented and everyone could move on. High security across the board, however, is extremely expensive and time prohibitive.