11 docs tagged with "rollback"

Objective and binary verification of the application of secure deployment practices in a specific project.

Specifics of exception management in the context of secure deployment - emergency deploy, break glass and deviations from promotion gates

Practical integration of secure release and deployment practices into the software lifecycle

Technical and operational indicators for the assessment of the effectiveness of the security controls in the deployment process and release management, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Formal policies required to ensure the security, reversibility and traceability of deployments in production.

Observability practices, runtime metrics and automatic rollback mechanisms after deployment.

Organisational policy that defines the requirements for active monitoring after each deploy to production, including a mandatory observation window, minimum health metrics, alert thresholds, human validation and rollback activation criteria, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the requirements for the rollback capability of deploys in production, including types of rollback by component (binary, configuration, database, infrastructure), activation criteria, RTO by criticality level, periodic testing procedures and traceability, proportional to the criticality level (L1, L2, L3).

Principles and controls to ensure a secure, validated and traceable deployment process in production environments

Organisational policy that defines the security requirements for the process of deploying software to production, including verification of signed artefacts, separation of environments, progressive rollout strategies, separation between automation and human authorisation, and end-to-end traceability, proportional to the criticality level (L1, L2, L3).

Canonical catalogue of security requirements for the deployment process (DPL-001 to DPL-011), with applicability by risk level and acceptance criteria for formal approval, artefact provenance, automated gates, rollback, deployment credentials, staging, post-deployment monitoring, release gates for agentic systems and end-to-end traceability.