The CISO's Pre-Flight Checklist: 25 Essential Security Controls Before ERP Cloud Go-Live

# -*- coding: utf-8 -*-
from odoo import models, fields, api, _
from odoo.exceptions import ValidationError

class CisoGoLivePreflight(models.TransientModel):
    _name = 'ciso.golive.preflight'
    _description = 'CISO Pre-Flight Security Validation Inspector'

    def run_security_inspection(self):
        """
        Verifies critical security hygiene before granting Go-Live Sign-Off.
        """
        errors = []

        # 1. Check for un-encrypted HTTP sessions
        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url', '')
        if not base_url.startswith('https://'):
            errors.append("CRITICAL: Base URL is not using encrypted HTTPS.")

        # 2. Check for active demo data or default users
        default_admin = self.env['res.users'].search([('login', '=', 'admin')], limit=1)
        if default_admin and default_admin.active:
            errors.append("WARNING: Default 'admin' user login is still active. Rename or replace.")

        # 3. Verify MFA activation on accounting managers
        finance_managers = self.env['res.users'].search([
            ('groups_id', 'in', [self.env.ref('account.group_account_manager').id]),
            ('active', '=', True)
        ])
        for mgr in finance_managers:
            if not mgr.totp_enabled:
                errors.append(f"MFA REQUIRED: Accounting Manager '{mgr.name}' does not have Two-Factor Auth enabled.")

        if errors:
            raise ValidationError(_("PRE-FLIGHT SECURITY CHECK FAILED:
" + "
".join(errors)))

        return {'status': 'PASSED', 'message': 'All automated security controls verified.'}