Treasury Operations — Security Checklist

Do you maintain documented security policies that define how treasury operations are conducted (e.g., access control principles, transaction verification requirements, incident response procedures)?

Is there an individual or team accountable for treasury operations (e.g., policy upkeep, reviews, operational hygiene)?

Do you maintain formal change management procedures for treasury infrastructure modifications (e.g., wallet setups, custody configurations, signer permissions, protocol integrations)?

Do you have a documented process to classify treasury wallets (e.g. multisigs) and accounts based on risk level and assign appropriate security controls?

Do you have documented rationale for choosing between custodial and non-custodial treasury solutions and technology choice like MPC, HSM?

Do you have documented policies for maximum fund allocations per wallet type and rebalancing triggers?

Do you maintain documented security configurations for custody platforms, including: Transaction policy rules, Multi-approval workflows and thresholds, Address whitelisting configurations, Velocity Limits)?

Do you maintain documented authentication requirements for treasury platforms (e.g., multi-factor authentication standards, session management)?

Do you have procedures for managing credentials and secrets used in treasury operations (e.g., API keys, service accounts)?

Do you conduct periodic reviews of who has access to treasury systems to ensure only authorized personnel retain access?

Do you implement network security controls for treasury access (IP whitelisting, VPN requirements, Geographic access restrictions)?

Do you implement controls to isolate owner account credentials?

Do you maintain documented procedures for transaction security and verification?

Do you conduct traning programs with all signers?

Do you have procedures for verifying transaction details before execution (e.g., recipient address validation, amount verification, network confirmation, test transactions, simulation requirements)?

Do you maintain secure communication procedures for coordinating treasury operations and verifying requests?

Do you have documented procedures for receiving funds?

Do you maintain procedures for conducting OTC (over-the-counter) transactions?

Do you maintain documented procedures for evaluating and monitoring DeFi protocols where treasury funds are deployed?

Do you have documented procedures for managing DeFi positions (e.g., emergency withdrawal procedures, alternative access methods if UIs are unavailable)?

Do you define and enforce exposure limits for protocol deployments (e.g., per protocol, chain, category)?

Do you have procedures for verifying smart contract addresses and managing token approvals?

Do you maintain documented procedures for evaluating and monitoring staking solutions where treasury funds are deployed?

Do you have documented procedures for managing staking positions (e.g., unstaking procedures, emergency exit methods, alternative access if primary UIs are unavailable)?

Do you define and enforce exposure limits for staking deployments (e.g. per staking provider, per liquid staking protocol, etc)?

Do you have procedures for verifying smart contract addresses?

Do you maintain documented operational security requirements for treasury personnel (signing device setup, device security requirements, etc)?

Do you have policies for secure storage and handling of sensitive treasury information (e.g., credentials, hardware wallets, backup materials)?

Do you have travel security procedures for treasury personnel with signing/access capabilities?

Do you monitor treasury transactions and account states for anomalous activity?

Do you maintain security incident response procedures specific to treasury operations (e.g., severity levels, escalation, containment, fund protection)?

Do you track external threat intelligence relevant to your treasury holdings and infrastructure (e.g., protocol vulnerabilities, DeFi risks)?

Do you conduct regular security drills and exercises to test incident response capabilities?

Do you monitor for vendor availability and service notifications (e.g., custody platform status, infrastructure provider alerts)?

Do you monitor transactions and wallet addresses for compliance risk?

Do you maintain security evaluation criteria for third-party services critical to treasury operations, including initial due diligence and ongoing monitoring?

Do you have procedures to verify vendors are implementing the security controls they contractually committed to?

Do you have backup infrastructure and alternate access methods for treasury continuity?

Do you maintain procedures for recording all treasury transactions in your accounting system with appropriate categorization and documentation?

Do you conduct periodic reconciliation between Custody platform records, Blockchain balances, Accounting records, etc?

Do you have documented procedures for treasury-related financial reporting?

Do you maintain insurance coverage appropriate for your treasury operations?