14 docs tagged with "governação"

Reinforced recommendations for organisations with high maturity or demanding normative requirements

Prescriptive validation, evidence and control strategies to ensure a secure, auditable and verifiable adoption of Infrastructure as Code.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Specifics of exception management in the context of CI/CD pipelines - bypass of gates, visibility and metrics

Specifics of exception management in the context of Infrastructure as Code - policy engines, enforcement and TTL

Secure coding practices, curation and selection of guidelines, automated validation and governance during development

Reference diagrams of the SbD-ToE measurement architecture - layer cascade, chapter-dimension mapping, and adoptability funnel.

Prescriptive practices for the governance, validation and control of reusable modules in IaC, ensuring security, provenance and traceability.

Guidance for organisations potentially within the scope of both DORA and NIS2

Planning and control strategies to ensure an effective and auditable adoption of security practices in Infrastructure as Code.

Eight key risk indicators for reporting to the CISO, senior management and the board. Focus on risk exposure and response capability, aggregating the technical indicators of the SbD-ToE domains into an actionable executive reading.

Instrument for assessing the adoption of the SbD-ToE model - 96 verification points organised by domain and risk level, derived from the organisational policies. It answers the question "is this team/organisation doing SbD-ToE?" and serves as a tool for self-assessment, internal audit and contractual requirement.

Organisational policy that defines the requirements for the definition, collection, analysis and reporting of security governance KPIs, including metric categories, reporting cadence, responsibilities, intervention thresholds and integration with maturity frameworks (SAMM, SSDF), proportionate to the criticality level (L1, L2, L3).

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.