29 docs tagged with "exceções"

Advanced governance practices applicable to contexts of high maturity or regulatory requirements

Practical cases of applying security governance in projects, exceptions and contracting

Formal, cross-cutting and authoritative process for the management of exceptions to security requirements and controls in SbD-ToE

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Binary control checklist of the application of governance practices per project

Strategies and cycles for keeping validations, KPIs and exceptions auditable

Organisational policy that defines the criteria, the formal process, the approval authorities, the compensating controls and the reassessment deadlines applicable to exceptions to known vulnerabilities (CVEs) in software dependencies, proportional to the application's criticality level (L1, L2, L3).

Technical and process indicators specific to the domain of organisational security governance (GOV), with thresholds by risk level and mapping to the cross-cutting governance dimensions of SbD-ToE.

Specifics of exception management in the context of CI/CD pipelines - bypass of gates, visibility and metrics

Specifics of exception management in the context of containers and images - admission control, image signing and vulnerability scanning

Specifics of exception management in the context of Infrastructure as Code - policy engines, enforcement and TTL

Specifics of exception management in the context of monitoring and operations - alert silencing, log retention and regulatory implications

Specifics of exception management in the context of secure deployment - emergency deploy, break glass and deviations from promotion gates

Specifics of exception management in the context of secure development - SAST, linters and code review

Specifics of exception management in the context of the application requirements of Ch. 02

Specifics of exception management in the context of the secure architecture requirements (ARC-001..013)

Structures, policies and practices to ensure organisational governance, supplier integration and transparency in the SbD-ToE cycle

Canonical catalogue of organisational security governance requirements (GOV-001 to GOV-017), with applicability by risk level and acceptance criteria for ownership, exceptions, contracting, traceability, continuous validation, maturity, technical onboarding of third parties, access review, coordinated vulnerability disclosure, privileged accounts and identity lifecycle.

Strategies for applying formal security governance to legacy systems and contracts

Definition of formal roles, responsibilities and the application security decision flow

Practical integration of governance, exception and contracting practices into the SbD-ToE lifecycle

Integration of requirements practices throughout the phases of the development lifecycle

Policies needed to frame and reinforce the secure development practices defined in this chapter

Formal policies that sustain the governance, exception and supplier management practices described in this chapter

Policies that underpin the definition, exception and validation of requirements

Organisational policy that defines the criteria, the formal process, the approval authorities and the traceability requirements for accepting residual risk in applications classified L1 to L3, including risks arising from controls not applied, unfixed findings and threats identified in threat modelling.

Cross-cutting organisational policy that defines the formal process for the submission, assessment, approval, recording and reassessment of exceptions to mandatory security controls, with approval authorities proportional to the application's risk level. It applies to all SbD-ToE chapters in which there are controls with formal mandatory status.

Visual diagrams of the governance, exception and formal validation flows

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.