Organisational policy that defines the mandatory axis-based risk classification model (Exposure, Data, Impact), the moments of application, the review criteria and the formal recording requirements for all applications developed or operated by the organisation.
Organisational policy that defines the mandatory cadence and the review triggers for the application risk classification, ensuring that the criticality level and the associated controls remain appropriate to the technical and business context throughout the entire lifecycle of the application.
Organisational policy that defines the criteria, the formal process, the approval authorities and the traceability requirements for accepting residual risk in applications classified L1 to L3, including risks arising from controls not applied, unfixed findings and threats identified in threat modelling.
Cross-cutting organisational policy that defines the formal process for the submission, assessment, approval, recording and reassessment of exceptions to mandatory security controls, with approval authorities proportional to the application's risk level. It applies to all SbD-ToE chapters in which there are controls with formal mandatory status.