18 docs tagged with "governanca"

How to use AI/GenAI to accelerate security testing (planning, triage, regressions, fuzzing and validation) without degrading evidence, confidentiality or human control

Formal, cross-cutting and authoritative process for the management of exceptions to security requirements and controls in SbD-ToE

Checklist and structured validation model for the screening, approval and onboarding of contractors

Six cross-cutting dimensions for measuring the health of the SbD-ToE programme, aggregating domain indicators from all chapters for executive and risk management visibility.

Technical and process indicators specific to the domain of organisational security governance (GOV), with thresholds by risk level and mapping to the cross-cutting governance dimensions of SbD-ToE.

Example RACI template (Responsible, Accountable, Consulted, Informed) for SbD implementation

Conceptual foundations of SbD-ToE, structure of the manual, roles, governance and mandatory baseline

Structures, policies and practices to ensure organisational governance, supplier integration and transparency in the SbD-ToE cycle

Ways of validating, reinforcing and governing the application of the controls defined in other chapters of SbD-ToE

Strategies for applying formal security governance to legacy systems and contracts

Definition of formal roles, responsibilities and the application security decision flow

Prescription for the controlled use of automated generation tools (including AI) in development, without changing the application requirements

Practical integration of governance, exception and contracting practices into the SbD-ToE lifecycle

Organisational policies that support the adoption of secure architecture practices

Set of recommended policies to sustain and legitimise the CI/CD security practices described in the chapter

Setup and use of an isolated environment for the practical training of contractors before access to real systems

Formalised and executable procedure for the secure termination of contractors and suppliers

How the governance model contributes to the evolution of security maturity