9 docs tagged with "evidencia"

Strategies for annotating security validation decisions and evidence in the code itself or in the development cycle

Decision, validation and minimum evidence criteria for secure architecture, including the architectural baseline model and invalidation conditions

Traceability model between ARC requirements, threats, architectural decisions and auditable evidence, with a matrix template and update criteria

Validation criteria per requirement (ARC-001 to ARC-013), with methods, moments and owners, organised by risk level

Prescriptive rules to ensure that security test results are verifiable, reproducible and auditable, with protection of critical assets and separation between automated signal and human decision.

Complete model for validating the requirements of the SbD-ToE catalogue - principles, methods by requirement type, lifecycle moments and a detailed plan by domain with operational tag, recommended method and expected evidence.

Canonical catalogue of requirements for the security testing programme (TST-001 to TST-010), with applicability by risk level and acceptance criteria for testing strategy, SAST, DAST, findings management, regression, pentesting and auditable evidence.

How to build and maintain a traceability matrix that links identified risks, canonical requirements, project operational tags, technical controls and auditable evidence.

Acceptance criteria, human validation and minimum evidence for threat models