Multi-Tenant Security Architecture Assessment Form

Multi-Tenant Security Architecture Assessment Form
Use this form to evaluate the security architecture of a multi-tenant system, including tenant isolation, access control, data segregation, shared-resource protections, monitoring, and overall risk posture.
Assessment Scope and Environment
Organization / Application Name
Assessor Role or Team
Deployment Model
Number of Tenants
Environments in Scope
Other
Primary Architecture Components and High-Level Summary
Tenant Isolation and Access Control
Tenant data separation approach
Other
Primary authentication method
Authorization model
Other
Privilege separation between tenants

1
2
3
4
5
6
7
8
9
10
1 is Weak, 10 is Strong
Tenant-scoped access enforcement consistency
Rows Not Enforced Partially Enforced Mostly Enforced Fully Enforced
User interface
API endpoints
Background jobs
Administrative functions
Reporting and exports

Access control maturity by dimension

Rows	Ad hoc	Defined	Managed	Measured	Optimized
Tenant isolation design
Authentication enforcement
Authorization enforcement
Privileged admin controls
Tenant-scoped access validation

Data Protection and Segregation
Data classification by tenant
Is tenant data encrypted at rest?
Is tenant data encrypted in transit?
Key management approach
Are backups segregated by tenant?
Describe data retention, deletion, and any shared database/schema/model details relevant to tenant separation
Network, Platform, and Shared Resource Controls
Is network segmentation enforced between tenants?
Firewall and security group isolation effectiveness
Rows Present Effective
Tenant-to-tenant traffic restrictions
Ingress filtering
Egress filtering
Management access restrictions
Are container or virtual machine isolation controls applicable in this environment?
Container or virtual machine isolation safeguards
Rows Present Effective
Process isolation
Kernel or hypervisor hardening
Namespace or VM boundary enforcement
Privileged workload restrictions
Shared service protections
Rows Present Effective
Shared database access controls
Shared cache segregation
Shared message bus permissions
Shared storage access restrictions
Rate limiting and throttling effectiveness

1
2
3
4
5
6
7
8
9
10
1 is Poor, 10 is Excellent
Resource quotas and noisy-neighbor protections
Rows Present Effective
CPU quotas
Memory quotas
Storage quotas
Bandwidth limits
Noisy-neighbor detection and mitigation
Logging, Monitoring, and Incident Response
Audit logging coverage
Other
Tenant-specific log separation
Other
Alerting and monitoring coverage
Other
Detection of cross-tenant access attempts
Other
Incident response owner
Escalation process, evidence links, notable gaps or incidents
Compliance, Risk, and Overall Assessment
Applicable compliance requirements
Other
Security review status
Identified risks and remediation priorities
Rows Priority Target timeline
Critical risk
High risk
Medium risk
Low risk
Overall maturity or risk rating

1
2
3
4
5
6
7
8
9
10
1 is Low, 10 is High
Final assessor recommendation and key findings
Overall score or rating
Should be Empty:

Select theme:

Rows	Not Enforced	Partially Enforced	Mostly Enforced	Fully Enforced
User interface
API endpoints
Background jobs
Administrative functions
Reporting and exports

Rows	Present	Effective
Tenant-to-tenant traffic restrictions
Ingress filtering
Egress filtering
Management access restrictions

Rows	Present	Effective
Process isolation
Kernel or hypervisor hardening
Namespace or VM boundary enforcement
Privileged workload restrictions

Rows	Present	Effective
Shared database access controls
Shared cache segregation
Shared message bus permissions
Shared storage access restrictions

Rows	Present	Effective
CPU quotas
Memory quotas
Storage quotas
Bandwidth limits
Noisy-neighbor detection and mitigation

Rows	Priority	Target timeline
Critical risk
High risk
Medium risk
Low risk

Multi-Tenant Security Architecture Assessment Form

Assessment Scope and Environment

Tenant Isolation and Access Control

Data Protection and Segregation

Network, Platform, and Shared Resource Controls

Logging, Monitoring, and Incident Response

Compliance, Risk, and Overall Assessment