2 docs tagged with "code review"

Organisational policy that defines the requirements for code review as a security control point, including a mandatory checklist, approval criteria, reviewer roles, minimum coverage and integration with automated tools, proportional to the criticality level (L1, L2, L3).

Technical and process indicators for the assessment of the effectiveness of secure development controls, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.