Quality Assurance (QA)
Overview
QA validates security requirements by turning them into clear, testable acceptance criteria.
It is no longer enough to validate that the software "works": it is necessary to prove that it works resiliently and protected against threats.
Key Responsibilities
- Validate security requirements (Ch. 02)
- Run functional and security tests in parallel
- Confirm that fixes do not introduce regressions
- Ensure that security controls work as expected
Organisational Context
QA is the first line of defence against vulnerabilities that slip past development. Without robust security testing, insecure code reaches production.
Regulatory Framework
QA gives effect to the demands of:
- NIS2: Verification of technical measures
- DORA: Regular digital resilience testing
Activities by Chapter
Ch. 01 - Application Classification
Validate that requirements applicable per risk level are met before entry into production, ensuring compliance with the assigned classification.
User Stories:
- US-05: Validation before go-live - Verify that requirements are met per level
Ch. 02 - Security Requirements
Ensure that all requirements have traceability in the backlog and an associated validation, preventing false positives or absence of control.
User Stories:
- US-04: Requirements traceability - Audit and tracking verification
- US-05: Definition of validation criteria - All requirements with clear validation
- US-09: Validation per requirement/domain - Objective, traceable evidence of fulfilment
- US-12: Validation of SEC-Lx-* tags in the pipeline - Automatic traceability
Ch. 03 - Threat Modelling
Translate threat modelling scenarios into objective tests, ensuring that identified threats have a counterpart in practical validations.
Ch. 04 - Secure Architecture
Validate the architecture before go-live, ensuring that all defined controls are in place and exceptions are documented.
User Stories:
- US-08: Architecture validation before go-live - Verify controls and documented exceptions
Ch. 06 - Secure Development
Conduct static and dynamic testing in collaboration with AppSec, validating that the code meets security standards.
User Stories:
- US-11: Central Archive of Validation Evidence - Centralised traceability and audit
Ch. 07 - Secure CI/CD
Ensure that pipelines incorporate automated security verification, validating that gates work correctly.
Ch. 10 - Security Testing
Run authenticated dynamic tests, fuzzing on critical endpoints and IAST instrumentation in staging to detect vulnerabilities exploitable at runtime.
User Stories:
- US-03: Authenticated DAST in Staging - Detect vulnerabilities exploitable at runtime
- US-06: Fuzzing targeted at critical APIs - Detect flaws invisible to conventional tests
- US-09: IAST with Instrumentation in Staging - Observe insecure calls at runtime
Ch. 11 - Secure Deployment
Validate releases in staging with a segregated environment, controlled data and functional + security tests. Run technical validations with risk-conditional gates.
User Stories:
- US-03: Validation in pre-production staging - Segregated environment with full tests
- US-04: Risk-conditional deploy gates - Proportional technical validations
Ch. 12 - Monitoring
Validate that runtime alerts and metrics are correctly configured, confirming that critical events are detected.
Ch. 13 - Training
Take part in structured hands-on exercises (labs, CTFs, simulations) to ensure knowledge that is applicable in a real context.
User Stories:
- US-05: Structured hands-on exercises - Consolidate knowledge through practice
Chapter References
For full context and framing: