6 docs tagged with "cap07"

Organisational policy that defines the requirements, execution criteria, findings management and responsibilities for dynamic security testing (DAST) and fuzzing, proportional to the application's risk level.

Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).

Organisational policy that defines the requirements for the storage, injection, rotation, audit and revocation of secrets (keys, tokens, credentials, certificates) in applications, CI/CD pipelines, containers and infrastructure, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the security requirements for continuous integration and delivery pipelines, including mandatory gates, integrated scanners, environment separation, artefact signing, secrets management in the pipeline and promotion approvals, proportional to the criticality level (L1, L2, L3).

Cross-cutting organisational policy that defines the formal process for the submission, assessment, approval, recording and reassessment of exceptions to mandatory security controls, with approval authorities proportional to the application's risk level. It applies to all SbD-ToE chapters in which there are controls with formal mandatory status.

Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.