Organisational policy that defines the formal process for reviewing and approving IaC execution plans (terraform plan or equivalent) before any apply in staging or production environments, including segregation of duties, plan signing, dual approval and execution windows, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the security requirements for the definition, validation, execution and maintenance of Infrastructure as Code (IaC), including configuration scanning, policy-as-code, environment separation, drift control, approved modules and plan signing, proportional to the criticality level (L1, L2, L3).
Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.