Skip to main content

Organisational Policies - Governance and Contracting

The effective adoption of Chapter 14 - Governance and Contracting - requires the existence of formal organisational policies that legitimise risk decisions, exceptions, third-party onboarding and contractual security requirements.

📌 Fundamental note​

✅ Governance is not an administrative layer: it is a structuring control that ensures the application of all the others.

These policies:

  • Establish clear responsibilities for the approval of exceptions and validations;
  • Ensure that risk decisions are traceable and justified;
  • Impose contractual criteria on third parties, aligned with the SbD model;
  • Enable formal integration with training, risk, lifecycle and audit flows.

⚡️ Without these policies, it is not possible to ensure or audit the consistent application of SbD practices.

📎 Recommended policies​

Policy NameMandatory?ApplicationSummary of required content
Exception Approval and Justification Policy✅ YesProjects with security requirementsCriteria for the submission, approval, validity and reassessment of exceptions.
Risk Decision Responsibilities Policy✅ YesAll applications classified by riskDefinition of owners per domain, authority, recording and traceability.
Third-Party Integration and Validation Policy✅ YesSuppliers, outsourcing, contractorsOnboarding process, training validation, mandatory contractual requirements.
Contractual Security Requirements Policy✅ YesContracting of software, services, critical operationsMinimum requirements per risk type, templates and mandatory legal review.
Approver and Decision-Maker Training Policy⚠️ OptionalOwners of exceptions, risk, complianceRequirement for up-to-date training on SbD before authorising decisions with a security impact.
Exception and Contract Review Cycle Policy⚠️ OptionalExceptions, contracts, critical systemsMandatory revalidation at each release or significant change in risk.

📄 Suggested structure of each policy​

Each organisational policy must contain:

  • A clear objective and scope (to whom it applies, when and in what context);
  • Mandatory criteria and rules, based on risk and on the decision-maker's role;
  • Approval and recording flow for decisions (who approves, where it is recorded);
  • Integration with training and competence validation;
  • Periodicity of the formal review of the policy;
  • Operational traceability mechanisms (e.g. exception → owner → deadline → affected release);

✅ The application of these policies is essential for SbD-ToE practices to be effective, auditable and sustainable.

✅ Final recommendations​

  • Policies must be formulated jointly by the security, development and legal teams;
  • They must be communicated, versioned and accessible to all parties involved;
  • Their application must be integrated into validation, approval and audit tools;
  • The existence of these policies is a prior requirement for any security programme that aims to be effective and accountable.

📁 Templates for these policies may be included in future as complementary annexes (60-*.md).