6 docs tagged with "findings"

Organisational policy that defines the requirements, execution criteria, findings management and responsibilities for dynamic security testing (DAST) and fuzzing, proportional to the application's risk level.

Mechanisms for continuous feedback of security test results to development and product teams.

Technical and operational indicators for the assessment of the effectiveness of the security testing programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Process for triaging, prioritising, tracking and resolving vulnerabilities detected in security testing.

Canonical catalogue of requirements for the security testing programme (TST-001 to TST-010), with applicability by risk level and acceptance criteria for testing strategy, SAST, DAST, findings management, regression, pentesting and auditable evidence.

Organisational policy that defines the requirements for the security testing strategy throughout the application lifecycle, including SAST, DAST, SCA, IAST, fuzzing and manual testing, with mandatory gates, finding triage SLAs and centralised management of results, proportional to the criticality level (L1, L2, L3).