Organisational policy that defines the requirements for active monitoring after each deploy to production, including a mandatory observation window, minimum health metrics, alert thresholds, human validation and rollback activation criteria, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the formal go/no-go decision process for software releases, including approval authorities by criticality level, separation between automatic signal and human decision, formal acceptance of residual risk and recording of evidence, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the rollback capability of deploys in production, including types of rollback by component (binary, configuration, database, infrastructure), activation criteria, RTO by criticality level, periodic testing procedures and traceability, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the storage, injection, rotation, audit and revocation of secrets (keys, tokens, credentials, certificates) in applications, CI/CD pipelines, containers and infrastructure, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the security requirements for the process of deploying software to production, including verification of signed artefacts, separation of environments, progressive rollout strategies, separation between automation and human authorisation, and end-to-end traceability, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the formal approval of software releases, including a pre-release security checklist, an automated compliance gate, go/no-go criteria, an immutable decision artefact and end-to-end commit→pipeline→release traceability, proportional to the criticality level (L1, L2, L3).