Implementation Checklist (Yahoo MDL (2018))

A practical rollout plan with measurable proof for account-security stabilization and litigation-aligned evidence discipline.

0–30 days (stabilize + baseline)

• Inventory internet-facing identity and account services and baseline protective controls
• Move high-risk account and auth control settings into governed change workflow
• Centralize auth/account security telemetry and define retention targets for incident response

Deliverables - Account-control baseline register with owners - Critical security change SOP with Legal/IR escalation - Telemetry coverage report for auth, admin, and account events

30–60 days (control effectiveness)

• Implement drift detection for key account and boundary controls
• Complete least-privilege review for admin and data-access roles
• Deploy detections for credential abuse and suspicious account patterns

Deliverables - Drift detection dashboard and alert routing - IAM access review pack with remediation tracking - Detection rule test results and investigation template

60–90 days (evidence readiness)

• Dry-run 48-hour evidence packet assembly and retrieval workflow
• Add independent control testing checkpoints for high-risk account controls
• Publish quarterly executive update template for MDL-relevant control KPIs

Deliverables - Evidence packet index with owners and retrieval paths - Mock discovery/regulator drill findings and fixes - Executive governance report template and cadence

Ongoing metrics (prove it's real)

• % high-risk control changes through approved workflow
• MTTR for auth/account detection alerts
• Privileged access remediation completion rate
• Log coverage percentage for critical account events
• Age of open high-severity findings