6 docs tagged with "conformidade"

Binary, auditable checklist to assess the practical adoption of the practices prescribed in Chapter 06 - Secure Development

Instrument for binary and auditable verification of the practical adoption of continuous security validation practices.

Structures, policies and practices to ensure organisational governance, supplier integration and transparency in the SbD-ToE cycle

Organisational policy that defines the requirements for the traceability of security practices throughout the application lifecycle, including a compliance repository per application, designation of security owners, periodic validations per SbD-ToE chapter, auditable evidence and an organisational dashboard, proportionate to the criticality level (L1, L2, L3).

Instrument for assessing the adoption of the SbD-ToE model - 96 verification points organised by domain and risk level, derived from the organisational policies. It answers the question "is this team/organisation doing SbD-ToE?" and serves as a tool for self-assessment, internal audit and contractual requirement.

Organisational policy that defines the security requirements applicable to the contractual lifecycle with suppliers and contractors, including pre-contractual due diligence, minimum contractual clauses by risk level, technical onboarding, compliance monitoring, periodic reassessment and secure offboarding, proportional to the criticality level (L1, L2, L3).