Organisational Policies - Secure Deployment

The consistent and effective application of Chapter 11 - Secure Deployment - requires the existence of formal organisational policies that regulate the technical and operational conditions for running code in production, with a focus on:

• Pre-deployment validation (readiness);
• Gating and formal approval;
• Logging, traceability and reversibility;
• Requirements for tested and documented rollback.

---

📌 Fundamental note

⚠️ The secure execution of software in production depends on well-defined and formalised technical and operational criteria.

These policies must:

• Establish rules for release approval and deployment gates;
• Make the existence of a tested rollback plan mandatory;
• Define roles and responsibilities for the authorisation, validation and execution of the deployment;
• Stipulate how traceability and reversibility are ensured.

📑 These policies must be aligned with the processes defined in the chapter and be auditable.

---

📓 Recommended policies

Policy Name	Mandatory?	Application	Summary of required content
Release Approval Policy	✅ Yes	All releases to production	Readiness criteria, mandatory checklist, owners and formal approval
Rollback and Reversibility Policy	✅ Yes	All releases with operational impact	Requirement for a rollback plan, prior testing, documented execution
Logging and Traceability Policy	✅ Yes	All production and staging environments	Requirements for logging, versioning, toggles and auditability
Deployment Gating and Automation Policy	⚠️ Optional	Pipelines with automated deployment	Definition of gates, automatic approval, blocking on findings
Staging Environment Validation Policy	✅ Yes	Projects with staging or pre-prod	Functional validation, metrics and readiness with evidence
Deployment Autonomy and Responsibility Policy	⚠️ Optional	Teams with self-service or continuous deployment	Who may authorise, minimum requirements, record of decisions

---

📄 Suggested structure of each policy

Each organisational policy must contain:

• Objective and scope;
• Mandatory rules and constraints (e.g. no deployment without a tested rollback);
• Roles and responsibilities (Dev, QA, AppSec, Product);
• Traceability, logging and evidence requirements;
• Mode of integration with pipelines (automatic, manual, gated);
• Periodicity of review and audit.

---

✅ Final recommendations

• These policies must be approved by the security, QA and product areas;
• They must be accessible, versioned and known to all teams involved in deployment;
• They must be implemented via CI/CD whenever possible, with integrated gates, validators and logs;
• Their existence is an essential requirement for secure, auditable and reversible deployment.

📁 Policy templates may be included in additional 60-*.md files in future versions of the manual.