2 docs tagged with "cap03"

Organisational policy that defines the criteria, the formal process, the approval authorities and the traceability requirements for accepting residual risk in applications classified L1 to L3, including risks arising from controls not applied, unfixed findings and threats identified in threat modelling.

Organisational policy that defines the mandatory nature, methodology, execution triggers, formal approval requirements, traceability and management of threat modelling artefacts throughout the lifecycle of applications classified L2 and L3.