{
  "schema_version": "1.0",
  "document": {
    "document_id": "TT-GDE-SCG-001",
    "title": "Secure Configuration Guide - ThinkTrends AI Platform",
    "version": "1.0",
    "effective_date": "2026-10-21",
    "fedramp_package_id": "FR2634659079",
    "classification": "PUBLIC - CUSTOMER-FACING",
    "review_cycle": "Quarterly, or upon any change to the platform's security-relevant configuration",
    "document_owner": "ISSO",
    "human_readable_guide": "TT-GDE-SCG-001, Version 1.0",
    "publication_location": "https://trust.paramify.com/thinktrends/thinktrends-ai-platform/deliverables",
    "version_sync_note": "This file carries the same version number as the human-readable guide and is published alongside it. The version increases with every substantive change to either."
  },
  "release_history": [
    {
      "version": "1.0",
      "date": "2026-10-21",
      "summary": "Initial release."
    }
  ],
  "usage": {
    "purpose": "Recommended secure configuration values for the security-relevant settings described in Sections 1-3 of the guide, for comparison against the settings you observe in your tenant.",
    "comparison_operators": {
      "equals": "Observed value must equal recommended_value.",
      "at_least": "Observed value must be greater than or equal to recommended_value.",
      "at_most": "Observed value must be less than or equal to recommended_value."
    },
    "units": "Durations are expressed in seconds unless a setting's unit field states otherwise.",
    "customer_configurable_note": "Every setting listed is a fixed, platform-wide baseline and cannot be changed by tenant administrators. Where a setting is listed as not customer-configurable, no tenant action is required to meet the recommended value."
  },
  "settings": [
    {
      "id": "authentication.sign_in_method",
      "guide_section": "1",
      "guide_section_status": "in_progress",
      "name": "Sign-in method",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": "passkey_with_user_verification",
      "comparison": "equals",
      "detail": "Passkey (WebAuthn / FIDO2), usable only after the user unlocks it on their device with Face ID, a fingerprint, or a device PIN. Every sign-in is therefore multi-factor. The platform does not use SMS or authenticator-app codes.",
      "customer_configurable": false,
      "security_implication": "Phishing-resistant multi-factor credential bound to the ThinkTrends domain; a look-alike site cannot capture or replay it."
    },
    {
      "id": "password.minimum_length",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Password minimum length",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": 12,
      "unit": "characters",
      "comparison": "at_least",
      "customer_configurable": false,
      "security_implication": "Baseline credential strength."
    },
    {
      "id": "password.require_uppercase",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Password requires uppercase characters",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": true,
      "comparison": "equals",
      "customer_configurable": false,
      "security_implication": "Baseline credential strength."
    },
    {
      "id": "password.require_lowercase",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Password requires lowercase characters",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": true,
      "comparison": "equals",
      "customer_configurable": false,
      "security_implication": "Baseline credential strength."
    },
    {
      "id": "password.require_numeric",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Password requires numeric characters",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": true,
      "comparison": "equals",
      "customer_configurable": false,
      "security_implication": "Baseline credential strength."
    },
    {
      "id": "password.require_symbol",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Password requires symbol characters",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": true,
      "comparison": "equals",
      "customer_configurable": false,
      "security_implication": "Baseline credential strength."
    },
    {
      "id": "password.temporary_password_validity",
      "guide_section": "2",
      "guide_section_status": "complete",
      "name": "Temporary (first-login) password validity",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": 604800,
      "unit": "seconds",
      "human_readable_value": "7 days",
      "comparison": "equals",
      "customer_configurable": false,
      "security_implication": "Limits how long an unused initial credential remains valid."
    },
    {
      "id": "session.access_token_validity",
      "guide_section": "3",
      "guide_section_status": "complete",
      "name": "Access token validity",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": 3600,
      "unit": "seconds",
      "human_readable_value": "1 hour",
      "comparison": "equals",
      "hard_limit": {
        "maximum": 3600,
        "unit": "seconds",
        "note": "Codified in infrastructure; cannot be exceeded."
      },
      "customer_configurable": false,
      "security_implication": "Bounds the exposure window of a stolen access token."
    },
    {
      "id": "session.id_token_validity",
      "guide_section": "3",
      "guide_section_status": "complete",
      "name": "ID token validity",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": 3600,
      "unit": "seconds",
      "human_readable_value": "1 hour",
      "comparison": "equals",
      "hard_limit": {
        "maximum": 3600,
        "unit": "seconds",
        "note": "Codified in infrastructure; cannot be exceeded."
      },
      "customer_configurable": false,
      "security_implication": "Bounds the exposure window of a stolen ID token."
    },
    {
      "id": "session.refresh_token_validity",
      "guide_section": "3",
      "guide_section_status": "complete",
      "name": "Refresh token validity",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": 86400,
      "unit": "seconds",
      "human_readable_value": "24 hours",
      "comparison": "equals",
      "hard_limit": {
        "maximum": 86400,
        "unit": "seconds",
        "note": "Codified in infrastructure; cannot be exceeded."
      },
      "customer_configurable": false,
      "security_implication": "Bounds how long a session can be renewed without signing in again."
    },
    {
      "id": "session.customer_forced_termination",
      "guide_section": "3",
      "guide_section_status": "complete",
      "name": "Customer-facing force-termination of an active session",
      "applies_to": [
        "administrator",
        "privileged",
        "standard"
      ],
      "recommended_value": "not_available",
      "comparison": "equals",
      "detail": "There is currently no customer-facing setting to terminate an individual active session before its token expires.",
      "customer_configurable": false,
      "security_implication": "An active session ends only when its token expires; the token lifetimes above bound that exposure."
    }
  ]
}