Security questions about an OpenText estate tend to arrive at awkward moments: an internal audit, a new CISO, a regulator's letter, or a near miss that makes someone ask who actually checks the certificates. The honest answer in many organisations is that the controls probably exist, but nobody can show the evidence quickly.
This checklist is a way to find out. It is a read only self-check that you can run on a Content Server estate without changing anything on production. It focuses on four control areas where evidence most often goes missing, and on a simple rule: every control needs an owner and current evidence.
It complements Nuca's 15 OpenText estate health checks, which cover the wider estate. This article goes deeper on the security side and on how to record what you find.
Why security controls need an owner and current evidence
Most OpenText estates have security procedures. The gap is usually between the procedure and the proof that it is still being followed.
Why is a documented procedure not enough?
A procedure describes what should happen. Evidence shows that it did. An access review policy that nobody has carried out since the last administrator left is a policy, not a control. Auditors know this, and so should you before they ask.
What counts as current evidence?
Evidence is current when it is recent enough to reflect how the estate runs today, relevant to the component being examined, and attributable to a named person or team. A recollection, a screenshot with no date or a procedure document on its own does not demonstrate that a control is operating.
Why treat missing evidence as an open question?
If you cannot find evidence, you do not yet know whether the control is working or failing. Record the item as open and assign someone to find out. Treating missing evidence as a failure creates alarm; treating it as a pass creates false comfort. Neither helps.
Define the boundary before you start
A useful health check is bounded. Decide what you are looking at before you look.
What should be in scope?
Name the Content Server instance, the database underneath, the environment and the administrative processes in scope. Include Archive Center and Extended ECM where they are part of the production estate. Record an accountable owner for each area, including the responsibilities shared between teams.
Who should take part?
Involve the people who hold the evidence: the platform administrators, the database administrators and the business administration team who manage users and permissions. Each holds part of the picture. A health check run by one team alone tends to find only that team's evidence.
Four control areas to check
These four areas are where evidence most often goes missing. They are not a complete security assessment, but they will show you quickly whether the basics are owned.
| Control area | Problem to resolve | Evidence to establish |
|---|---|---|
| Account and access reviews | A review record may not show what was checked, when, or who owns the follow-up | The current review record or approval trail, covering in-scope accounts and access, with a responsible owner |
| Certificates | The owner, expiry tracking or renewal process may be unclear | The certificate inventory, expiry tracking or renewal procedure, and who tracks expiry and renewal |
| Audit records | It may be unclear where logs are generated, retained and reviewed, or who follows up | The log locations and review process, the owner and the most recent evidence that records were reviewed |
| Backup and restore | Backup records alone do not show what the latest restore test covered | Backup records and the latest restore test evidence: date, recovery owner, what was covered and what remains untested |
How do you check account and access reviews?
Find the most recent access review for the estate. Check that it covers the accounts and access in scope, including administrative and service accounts, that it identifies who carried out the review, and that someone owns the follow-up actions. Pay particular attention to accounts belonging to people who have left and to shared administrative logins.
How do you check certificates?
Find the inventory of certificates used by the estate and its integrations. For each one, identify the owner, how expiry is tracked and how renewal is carried out. An expired certificate is one of the most common causes of an avoidable outage, and it is almost always a question of ownership rather than technology.
How do you check audit records?
Identify where audit and log records are generated, how long they are retained and how they are reviewed. Check which audit events are enabled for your installed version against the audit documentation that OpenText publishes for that version. Then find the most recent evidence that someone actually reviewed the records and followed up on anything that needed attention.
How do you check backup and restore?
A backup is only as good as the last restore. Find the backup records and the evidence from the most recent restore test. Record the test date, the recovery owner, what the test covered and what remains untested. Check that the test restored the database and the file store from the same point in time, and that the search index was restored or rebuilt to match.
A simple four-part review path
Run the self-check in four steps. Keep it read only throughout.
Step one: define the boundary
Name the instance, database, environment and administrative processes in scope, and the accountable owner for each.
Step two: gather existing evidence
Examine records already held by the platform, database and business administration teams. Capture where each piece of evidence is held, its date and the component it relates to.
Step three: test each answer against the evidence
Check that the evidence is current, relevant to the component and attributable to a responsible person or team. A procedure or recollection alone does not demonstrate that a control is operating.
Step four: record the status and the open question
Separate verified controls from partially evidenced or unknown items. Note who owns each follow-up. Configuration changes, updates and access changes are remediation work and should go through your normal authorised change process, not the health check.
Three evidence states, three different meanings
Recording results consistently matters as much as finding them. Use three states and keep them distinct.
What does verified mean?
Current, relevant evidence demonstrates the control for the component being examined, and an accountable owner has been identified.
What does partially evidenced mean?
Some evidence exists, but an aspect of its scope, currency, ownership or operation still needs confirmation. Record exactly what is missing.
What does unknown mean?
Relevant evidence has not been shown. Keep the item open rather than calling it a confirmed control or a confirmed failure, and assign someone to find out.
Choose the right kind of check
A self-check, a vulnerability scan and a formal review answer different questions. Using one in place of another leads to misplaced confidence.
How is a self-check different from a vulnerability scan?
A vulnerability scan is a different method with a different purpose and scope. It can find technical weaknesses, but a scan result alone does not establish who owns a control or whether its operating evidence is current. The self-check fills that gap. Many estates need both.
When is a formal review the better next step?
If the self-check leaves many items unknown, or if the estate depends heavily on one person, an independent review may be worth considering. Nuca's Estate Continuity Review covers the live production estate: the platform, the database underneath, ownership, patching and version currency, and single-person dependency. It takes two weeks elapsed and five senior days, at a fixed price agreed before it starts. The fee is credited against the work that follows. It is review only: nothing on production changes. You receive a written findings report, a ranked remediation plan and a walkthrough with the estate owner.
Close
A security audit of an OpenText estate does not have to start with tools or consultants. It starts with four questions: who owns this control, where is the evidence, is it current, and what is still unknown? Answer those honestly for access, certificates, audit records and restore, record the results in three clear states, and you will know far more about your estate than most audits reveal.
If you would like to talk through what you find, book a 45-minute continuity check call. You describe the estate and what worries you; we tell you whether a review would find anything worth having.
Frequently asked questions
Related reading