19 docs tagged with "checklist"

Binary and auditable checklist to assess the practical adoption of the practices prescribed in Chapter 09 - Containers and Images

Binary verification of the application of the practices prescribed in Chapter 05

Binary control checklist of the adoption of monitoring, alerting, incident response and continuous operational health signal practices.

Objective verification checklist of the adoption of security practices in CI/CD pipelines

Objective and binary verification of the application of secure deployment practices in a specific project.

Binary, auditable checklist to assess the practical adoption of the practices prescribed in Chapter 06 - Secure Development

Instrument for binary and auditable verification of the practical adoption of continuous security validation practices.

Binary, traceable verification checklist of the adoption of the practices of Chapter 13.

Binary control checklist of the application of governance practices per project

Organisational policy that defines the requirements for code review as a security control point, including a mandatory checklist, approval criteria, reviewer roles, minimum coverage and integration with automated tools, proportional to the criticality level (L1, L2, L3).

Checklist and structured validation model for the screening, approval and onboarding of contractors

This checklist applies to all applications classified according to the criteria defined in Chapter 01 - Application Criticality Classification.

Binary and auditable checklist to verify the practical application of the security prescriptions for IaC.

Binary, auditable checklist for controlling the application of the secure architecture requirements

Mandatory per-project verifications to guarantee the application of the defined requirements

Binary, auditable checklist of the adoption of the threat modelling practices of Chapter 03

Instrument for assessing the adoption of the SbD-ToE model - 96 verification points organised by domain and risk level, derived from the organisational policies. It answers the question "is this team/organisation doing SbD-ToE?" and serves as a tool for self-assessment, internal audit and contractual requirement.

Organisational policy that defines the requirements for the formal approval of software releases, including a pre-release security checklist, an automated compliance gate, go/no-go criteria, an immutable decision artefact and end-to-end commit→pipeline→release traceability, proportional to the criticality level (L1, L2, L3).

Formal verification checklist for secure technical onboarding, with a record and validation per role.