Organisational Policies - Secure Development

The effective application of Chapter 06 - Secure Development - requires the existence of formal organisational policies that frame, reinforce and legitimise the practices of secure coding, code review and validation.

These policies ensure that:

• Security is treated as an essential quality criterion;
• Security requirements have concrete expression in the development lifecycle;
• There are clear, auditable rules that can be applied across engineering teams.

---

📄 Relevant Organisational Policies

Policy Name	Mandatory?	Application	Summary of the required content
Secure Coding Standards Policy	✅ Yes	All development teams	Formal guide with good practices, prohibited patterns and mandatory rules per stack or language.
Code Validation and Review Policy	✅ Yes	All repositories and pipelines	Requirements for peer review, use of linters, @sec: tags, traceability and blocking.
Code Dependency Approval Policy	✅ Yes	Introduction of libraries and packages	Formal process to approve and track reused external or internal dependencies.
Technical Exception Justification Policy	⚠️ Optional	Security team, tech leads	Acceptable exception cases, documentation requirements, deadline and formal approval.
Policy on the Controlled Use of GenAI in Development	⚠️ Optional	Teams with access to GenAI tools	Criteria for the use of automatic suggestions (e.g. Copilot); validation, origin annotation, mandatory review.

---

📃 Minimum structure of each policy

Each organisational policy must contain, at a minimum:

• Objective and scope of the policy;
• Mandatory criteria per application type, language, stack or team;
• Roles and responsibilities (devs, reviewers, tech leads, security);
• Mandatory integration points in the SDLC or pipeline;
• Requirement for traceable evidence (tags, logs, reports);
• Review frequency and validation of the policy itself.

---

✅ Final recommendations

• The policies must be officially approved and published by security and engineering management;
• They must be accessible, communicated effectively and integrated into onboarding and technical review processes;
• There must be mechanisms for validating and auditing the application of the policies;
• Their existence and application are formal criteria of maturity in secure development;
• It is recommended that the policies be accompanied by practical examples, checklists and reusable templates.

📁 Policy templates may be included as complementary 60-*.md files in future versions of the manual.