# Secure configuration guide

> Recommended security settings for an organization that holds federal information or CUI, how to manage Admin accounts, and how account access is handled.

Source: https://docs.specset.com/docs/secure-configuration · Section: Organization · Last updated: 2026-10-08

This guide is for the people who administer a Specset organization. It names the accounts that control an organization, gives the security settings Specset recommends for an organization that holds federal information or CUI, and explains how account access is requested and recovered.

Recommended settings version **2026.09.18.2**. See [Versions](https://docs.specset.com/docs/secure-configuration#versions).

## Accounts that control an organization

| Role | FedRAMP term | What it can do |
| --- | --- | --- |
| **Admin** | Top-level administrative account | Everything in the organization: security settings, identity providers, integrations, and everything a Manager can do. |
| **Manager** | Privileged account | Open every project, and add, change, and deactivate members up to the Manager role. |
| **Member** | Not privileged | Work in the projects they are assigned to. |

Set roles on the **Members** page. No one can grant a role above their own. See [Members & roles](https://docs.specset.com/docs/team-roles).

Specset creates each organization, adds its first Admin, and turns CUI mode on. Specset staff who can do this sign in through corporate SSO with a security key or passkey, and are able to change an organization's members and settings. They cannot read or set your password, or sign in as you.

## Recommended settings

Specset creates an organization for federal information or CUI with CUI mode on and the settings below already saved. Only an Admin can change them, under **Org Settings → Security & SSO**. For each control, see [Organization security](https://docs.specset.com/docs/organization-security).

![Organization authentication settings with separate SSO policy, MFA requirement, and allowed sign-in methods](https://docs.specset.com/images/docs/organization-security/authentication-policy.png)

| Setting | Recommended | What it does |
| --- | --- | --- |
| **Single sign-on (SSO)** | Not allowed | Members sign in with a Specset password and passkey. To use your identity provider, see [Use your identity provider](https://docs.specset.com/docs/secure-configuration#use-your-identity-provider). |
| **Authentication requirement** | MFA required | A password alone does not open the organization; a passkey does. **Phishing-resistant MFA required** is stronger: only an approved passkey or qualifying SSO is accepted, recovery goes through Specset support, and the requirement cannot be lowered on this page. |
| **Passwords** | Allowed | Needed to accept an invitation, set up a passkey, and recover an account without SSO. Passwords have at least 15 characters and are checked against common passwords. |
| **Passkeys** | Allowed | The second factor. Each member adds one under **Account Settings → Sign-in & security**. |
| **Authenticator app codes** | Not allowed | Authenticator-app setup is not available in production. |
| **Onboarding policy** | Invite Only | Only people a Manager or Admin adds can join. The other choices let people who sign in through your identity provider from a verified domain join as Members, without approval (**Open Domain**) or with it (**Manual Approval**). |
| **Session duration (minutes)** | 720 | A sign-in lasts 12 hours. In a CUI organization this also limits how old a sign-in may be, so shortening it can make members sign in again. With MFA required, a sign-in is never accepted for more than 24 hours. The page accepts 60 to 525,600. |

CUI mode is set by Specset, not by an Admin. It keeps model, embedding, and web-search calls in Specset's Google Cloud Assured Workloads project, and turns off the support messenger and the Procore and Autodesk integrations.

### Use your identity provider

If your organization has Okta, Microsoft Entra ID, or Google Workspace, you can require it in place of Specset passwords and passkeys.

1. Connect the provider and test a member sign-in. See [Single sign-on](https://docs.specset.com/docs/single-sign-on).
2. Ask Specset support to confirm that sign-ins from your provider meet the **MFA required** setting. Connecting a provider does not establish this by itself.
3. Set **Single sign-on (SSO)** to **Required** and click **Save**.

Sign-in and account recovery then depend on your identity provider. Specset cannot reset them.

## Manage Admin accounts

### Set up the first Admin

1. Accept the emailed invitation and set a password.
2. Add a passkey under **Account Settings → Sign-in & security**.
3. Generate recovery codes and store them somewhere safe. See [Account security](https://docs.specset.com/docs/account-security).
4. Add a second Admin. Give each Admin their own account, and do not share one.

### Change security settings

Saving under **Security & SSO** asks for a sign-in made in the last five minutes that meets both the current and the new settings, so you cannot save settings that lock you out. Saving does not enroll anyone else. Before you raise a requirement, check that every member has a passkey or a working SSO sign-in.

### Review your settings

Compare your settings with this guide after each change and whenever you review who has access. Each saved change is emailed to the Admin who made it. Specset does not show a history of earlier values or of role changes, so keep your own record.

Any member can read the settings as JSON through the Specset API, for example with `specset api` in the Specset command-line tool:

```graphql
query OrgSecuritySettings($orgId: ID!) {
  org(id: $orgId) {
    cuiModeEnabledAt
    authPolicy
    authenticationStrength
    nativePasswordEnabled
    nativePasskeysEnabled
    nativeTotpEnabled
    onboardingPolicy
    sessionMaxAgeMinutes
    identityProviders { provider displayName issuerUrl hostedDomains }
  }
}
```

The recommended settings return these values. The same values, with their version and release history, are published as a file for tools to compare against: [secure-configuration.json](https://docs.specset.com/secure-configuration.json).

```json
{
  "authPolicy": "PasswordOnly",
  "authenticationStrength": "MultiFactor",
  "nativePasswordEnabled": true,
  "nativePasskeysEnabled": true,
  "nativeTotpEnabled": false,
  "onboardingPolicy": "InviteOnly",
  "sessionMaxAgeMinutes": 720
}
```

To run a query, save it to a file and pass your organization's ID, which `specset org list` shows:

```bash
specset api --query "$(cat org-security-settings.graphql)" -F orgId=<org-id>
```

Any member can also list who holds each role, the same way. Add `roles: [Admin, Manager]` after `statuses: [Active]` to list only the Admin and Manager accounts:

```graphql
query OrgMembersAndRoles($orgId: ID!) {
  orgMembers(orgId: $orgId, statuses: [Active]) {
    role
    status
    user { email firstName lastName }
  }
}
```

### Remove an Admin

1. Give another person the Admin role first. An organization can remove its last Admin, and restoring one takes a request to Specset support.
2. On the **Members** page, deactivate the departing Admin or remove their seat. Access ends on their next request. Deactivating is reversible and records who did it and when.
3. If you use SSO, also disable the person in your identity provider.

A Manager can deactivate an Admin, so give the Manager role only to people you would trust with that.

To close an organization and delete its data, an Admin writes to [support@specset.com](mailto:support@specset.com).

## Account access

A person who needs access asks a Manager or Admin of their organization, not Specset.

- **Add a member.** **Add member** creates an invited seat with no access until the person accepts. Re-sending an invitation replaces its link. Invitation links do not expire, so revoke an invitation you no longer want.
- **Remove a member.** Deactivate the member or remove the seat. Disabling a person in your identity provider does not end a Specset session that is already open, so deactivate them in Specset too.
- **Forgotten password.** **Forgot your password?** emails a single-use link that is valid for ten minutes. A reset signs out every session and keeps the MFA and SSO requirements.
- **Lost passkey.** With their password and a saved recovery code, a person has five minutes to set up a replacement. The old passkeys, codes, and sessions are then revoked.
- **SSO.** Recover the account in your identity provider.

Every credential, recovery, and email change is emailed to the account's holder.

### When to contact Specset

Write to [support@specset.com](mailto:support@specset.com) to:

- create an organization or restore its Admin,
- connect a Google Workspace provider, or add email domains for Okta. Specset confirms that you own each domain first,
- recover an account that has no self-service recovery, such as one in an organization that requires phishing-resistant MFA.

A recovery request comes through your organization's Admin. Specset confirms the person's identity separately from the request and then issues a one-use approval that lasts one hour. The account holder is emailed, and the person still needs their password and a new passkey.

## Versions

| Version | Date | Change |
| --- | --- | --- |
| 2026.09.18.2 | 2026-09-22 | First version. New CUI organizations are created with these settings. |

A change to the recommended settings gets a new version, a row here and a new edition of [secure-configuration.json](https://docs.specset.com/secure-configuration.json). Specset does not apply a new version to an organization that already exists, or to one switched to CUI mode after it was created. An Admin applies the settings from this guide.