{
  "document": "Secure Configuration Guide",
  "service": "Remedio",
  "version": "1.2",
  "lastReviewed": "2026-09-16",
  "humanReadableUrl": "https://trust.remedio.io/scg",
  "markdownUrl": "https://trust.remedio.io/scg.md",
  "machineReadableUrl": "https://trust.remedio.io/scg.json",
  "sections": [
    {
      "level": 1,
      "title": "About this guide"
    },
    {
      "level": 1,
      "title": "Account model"
    },
    {
      "level": 1,
      "title": "Securely accessing the tenant"
    },
    {
      "level": 2,
      "title": "Access path"
    },
    {
      "level": 2,
      "title": "Identity provider integration"
    },
    {
      "level": 2,
      "title": "Local accounts"
    },
    {
      "level": 2,
      "title": "Session behaviour"
    },
    {
      "level": 1,
      "title": "Managing device groups"
    },
    {
      "level": 2,
      "title": "Creating a group"
    },
    {
      "level": 2,
      "title": "Static and dynamic membership"
    },
    {
      "level": 1,
      "title": "Managing administrative roles"
    },
    {
      "level": 2,
      "title": "Creating"
    },
    {
      "level": 2,
      "title": "Operating"
    },
    {
      "level": 2,
      "title": "Decommissioning"
    },
    {
      "level": 1,
      "title": "Recommended secure configuration baseline"
    },
    {
      "level": 1,
      "title": "Version history"
    }
  ],
  "recommendedBaseline": [
    {
      "id": 1,
      "setting": "Console authentication",
      "recommendedState": "Federated to customer IdP over SAML"
    },
    {
      "id": 2,
      "setting": "MFA",
      "recommendedState": "Enforced at the IdP for all Remedio users"
    },
    {
      "id": 3,
      "setting": "Local accounts",
      "recommendedState": "None, or a single documented and tested break-glass account"
    },
    {
      "id": 4,
      "setting": "Device group scope",
      "recommendedState": "Narrow enough that Full over the group grants no more than the role requires"
    },
    {
      "id": 5,
      "setting": "Device group changes",
      "recommendedState": "Reviewed under the same process as role changes"
    },
    {
      "id": 6,
      "setting": "Roles holding Full on All my devices",
      "recommendedState": "Two at most"
    },
    {
      "id": 7,
      "setting": "Members per administrative role",
      "recommendedState": "Two or more, to avoid lockout"
    },
    {
      "id": 8,
      "setting": "Role naming",
      "recommendedState": "Function-based, not person-based"
    },
    {
      "id": 9,
      "setting": "Administrative access grant",
      "recommendedState": "Through a directory group, not named individuals"
    },
    {
      "id": 10,
      "setting": "Access review cadence",
      "recommendedState": "Quarterly, covering role membership, device groups and access level"
    },
    {
      "id": 11,
      "setting": "Administrator offboarding",
      "recommendedState": "Directory removal, local account removal, role backfill"
    }
  ],
  "releaseHistory": [
    {
      "version": "1.2",
      "date": "2026-09-16",
      "change": "Added operating guidance for administrative roles. New recommended default: review role membership, device groups and access level quarterly"
    },
    {
      "version": "1.1",
      "date": "2026-09-15",
      "change": "Initial guide"
    }
  ]
}