10 docs tagged with "classificação"

🎯 Objective

Canonical catalogue of application criticality classification requirements (CLA-001 to CLA-008), with applicability by risk level and acceptance criteria for formal classification, reclassification, residual risk and proportionality of controls.

Determining the criticality of applications in order to apply proportionality in security controls

Organisational policy that defines the mandatory axis-based risk classification model (Exposure, Data, Impact), the moments of application, the review criteria and the formal recording requirements for all applications developed or operated by the organisation.

Applying criticality classification throughout the development lifecycle

Why — determining the criticality of applications in order to apply proportionality in security controls

Technical and process indicators for assessing the quality, coverage and currency of application risk classification, with thresholds per risk level and mapping to SbD-ToE cross-cutting governance dimensions.

Organisational policy that defines the mandatory cadence and the review triggers for the application risk classification, ensuring that the criticality level and the associated controls remain appropriate to the technical and business context throughout the entire lifecycle of the application.

The effective adoption of Chapter 01 - Risk Management - requires the existence of formal organisational policies that frame, legitimise and sustain the application of the practices described in this chapter.

Risk management in software should not be seen as a one-off event, but as an iterative and evolving process throughout the application lifecycle.