34 docs tagged with "auditoria"

Advanced governance practices applicable to contexts of high maturity or regulatory requirements

Canonical catalogue of application criticality classification requirements (CLA-001 to CLA-008), with applicability by risk level and acceptance criteria for formal classification, reclassification, residual risk and proportionality of controls.

Canonical catalogue of SbD-ToE application security requirements, organised by technical domain, with applicability by risk level (L1–L3) and minimum acceptance criteria for validation, audit and integration into backlogs.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Binary and auditable checklist to assess the practical adoption of the practices prescribed in Chapter 09 - Containers and Images

Objective verification checklist of the adoption of security practices in CI/CD pipelines

Binary, auditable checklist to assess the practical adoption of the practices prescribed in Chapter 06 - Secure Development

Binary, traceable verification checklist of the adoption of the practices of Chapter 13.

Canonical catalogue of security requirements for containers and images (CNT-001 to CNT-012), with applicability by risk level and acceptance criteria for the selection of base images, hardening, signing, scanning, runtime policies and access to registries.

Strategies and cycles for keeping validations, KPIs and exceptions auditable

Canonical catalogue of security requirements for the management of third-party dependencies (DEP-001 to DEP-010), with applicability by risk level and acceptance criteria for SBOM, SCA, library governance and update policies.

Specifics of exception management in the context of CI/CD pipelines - bypass of gates, visibility and metrics

Canonical catalogue of organisational security governance requirements (GOV-001 to GOV-017), with applicability by risk level and acceptance criteria for ownership, exceptions, contracting, traceability, continuous validation, maturity, technical onboarding of third parties, access review, coordinated vulnerability disclosure, privileged accounts and identity lifecycle.

Canonical catalogue of security requirements for IaC projects (IAC-001 to IAC-013), organised by risk level, with acceptance criteria for the governance of repositories, pipelines, state, modules and configuration drift.

Responsibilities of Auditors in the SbD-ToE

Canonical catalogue of requirements for the security monitoring and operations programme (OPS-001 to OPS-017), with applicability by risk level and acceptance criteria for centralised logging, critical events, retention, SIEM, alerts, response SLA, correlation, integration with the IRP, behavioural detection, effectiveness metrics and continuous operational health signals, backups with tested restore and recovery of the application.

Model for the recording and formal justification of security decisions and deliverables

Organisational policy that defines the requirements for the traceability of security practices throughout the application lifecycle, including a compliance repository per application, designation of security owners, periodic validations per SbD-ToE chapter, auditable evidence and an organisational dashboard, proportionate to the criticality level (L1, L2, L3).

Mandatory per-project verifications to guarantee the application of the defined requirements

Binary, auditable checklist of the adoption of the threat modelling practices of Chapter 03

Instrument for assessing the adoption of the SbD-ToE model - 96 verification points organised by domain and risk level, derived from the organisational policies. It answers the question "is this team/organisation doing SbD-ToE?" and serves as a tool for self-assessment, internal audit and contractual requirement.

Canonical catalogue of structural and design security requirements (ARC-001 to ARC-013), organised by risk level, with acceptance criteria for architecture reviews, ADRs and technical audits.

Canonical catalogue of security requirements for continuous integration and delivery pipelines (CIC-001 to CIC-010), with applicability by risk level and acceptance criteria for pipeline design, secrets management, runner isolation, artefact integrity and security gates.

Canonical catalogue of security requirements for the deployment process (DPL-001 to DPL-011), with applicability by risk level and acceptance criteria for formal approval, artefact provenance, automated gates, rollback, deployment credentials, staging, post-deployment monitoring, release gates for agentic systems and end-to-end traceability.

Canonical catalogue of security requirements for the development process (DEV-001 to DEV-009), with applicability by risk level and acceptance criteria for code guidelines, linters, formal review, exception management, provenance and traceable annotations.

Formalised and executable procedure for the secure termination of contractors and suppliers

Complete model for validating the requirements of the SbD-ToE catalogue - principles, methods by requirement type, lifecycle moments and a detailed plan by domain with operational tag, recommended method and expected evidence.

Canonical catalogue of requirements for the security testing programme (TST-001 to TST-010), with applicability by risk level and acceptance criteria for testing strategy, SAST, DAST, findings management, regression, pentesting and auditable evidence.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Canonical catalogue of threat modelling requirements (THR-001 to THR-007), with applicability by risk level and acceptance criteria for threat identification, formal disposition, requirement derivation and methodological traceability.

Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.

How to build and maintain a traceability matrix that links identified risks, canonical requirements, project operational tags, technical controls and auditable evidence.

Ensure that each pipeline execution and each artefact can be traced back to the associated commit, origin and person responsible.

Canonical catalogue of security training and onboarding requirements (TRN-001 to TRN-009), with applicability by risk level and acceptance criteria for training tracks, verifiable onboarding, Security Champions and training effectiveness.