Canonical catalogue of application criticality classification requirements (CLA-001 to CLA-008), with applicability by risk level and acceptance criteria for formal classification, reclassification, residual risk and proportionality of controls.
Organisational policy that defines the criteria, the formal process, the approval authorities, the compensating controls and the reassessment deadlines applicable to exceptions to known vulnerabilities (CVEs) in software dependencies, proportional to the application's criticality level (L1, L2, L3).
Organisational policy that defines the formal go/no-go decision process for software releases, including approval authorities by criticality level, separation between automatic signal and human decision, formal acceptance of residual risk and recording of evidence, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the criteria, the formal process, the approval authorities and the traceability requirements for accepting residual risk in applications classified L1 to L3, including risks arising from controls not applied, unfixed findings and threats identified in threat modelling.
Residual risk is the risk that remains after the effective application of the defined controls, and it is the factual basis for any conscious decision to accept, further mitigate or reject.