Check out any regulated banks audit process for how to secure systems that touch money