HIBT security audit best practices