11 docs tagged with "deploy"

Objective and binary verification of the application of secure deployment practices in a specific project.

Specifics of exception management in the context of secure deployment - emergency deploy, break glass and deviations from promotion gates

Strategy for ensuring that all code executed in production has previously been validated and authorised.

Use of feature toggles with security, traceability and the capacity for reversal in production.

Practical integration of secure release and deployment practices into the software lifecycle

Technical and operational indicators for the assessment of the effectiveness of the security controls in the deployment process and release management, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Formal policies required to ensure the security, reversibility and traceability of deployments in production.

Organisational policy that defines the requirements for the rollback capability of deploys in production, including types of rollback by component (binary, configuration, database, infrastructure), activation criteria, RTO by criticality level, periodic testing procedures and traceability, proportional to the criticality level (L1, L2, L3).

Principles and controls to ensure a secure, validated and traceable deployment process in production environments

Organisational policy that defines the security requirements for the process of deploying software to production, including verification of signed artefacts, separation of environments, progressive rollout strategies, separation between automation and human authorisation, and end-to-end traceability, proportional to the criticality level (L1, L2, L3).

Ensure that each pipeline execution and each artefact can be traced back to the associated commit, origin and person responsible.