# OZI-RIS P1 Security Operations

## Account controls

- MFA is required by default. Users enroll a TOTP authenticator at first sign-in and receive eight one-use recovery codes.
- Five failed sign-ins lock an account for 15 minutes by default. Administrators can unlock it from User Administration.
- Passwords require at least 12 characters, mixed case, numbers, symbols, and a compromised-password check.
- Password, role, active-status, and administrator account changes increment the session version and terminate existing sessions.
- Inactivity timeout, lockout thresholds, MFA enforcement, and audit retention are configurable in Settings.

## Emergency access

Break-glass access requires password confirmation and a clinical justification of at least 20 characters. It lasts 30 minutes and grants only read-oriented clinical permissions. Activation and every permission use are audit events. It never grants administration, configuration, reporting finalization, deletion, or data mutation.

## Audit evidence

Audit records are append-only at the application layer and linked using HMAC-SHA256 hashes. Export is available to authorized audit users. Database administrators must also restrict direct UPDATE/DELETE access and protect database backups; application hashing is not a substitute for database access control.

## Attachments

Only PDF, JPEG, PNG, and plain-text clinical attachments are accepted. Files enter private quarantine and are downloadable only after a configured ClamAV scan returns clean. If the scanner is absent or fails, the file remains quarantined. Downloads force attachment disposition and restrictive security headers.

## Production gate

Run `php artisan security:check-production` during deployment. Production must use HTTPS, secure HTTP-only cookies, disabled debug mode, an application key, and a safe SameSite policy. Follow with authorization-boundary testing and an independent penetration test before clinical launch.
