- Check that systemd services are not being ran as root - We need to define some system to identify or for apps to declare that they legitimately run using root (e.g. backup automation) - Same for cron job