9 docs tagged with "SAMM"

Structured identification, analysis and mitigation of threats during the development lifecycle

Strategies and practices for continuously validating application security through automated, manual and offensive testing.

Security practices for the definition, validation and management of infrastructure as code

Formal policies required to legitimise and operationalise the continuous validation of application security.

Organisational policy that defines the requirements for the definition, collection, analysis and reporting of security governance KPIs, including metric categories, reporting cadence, responsibilities, intervention thresholds and integration with maturity frameworks (SAMM, SSDF), proportionate to the criticality level (L1, L2, L3).

Definition, application, validation and traceability of application security requirements by risk level

Strategies and practices for continuously validating application security through automated, manual and offensive testing

Organisational policy that defines the requirements for the security training and upskilling programme, including mandatory onboarding, training tracks by profile and risk level, the Security Champions programme, practical exercises, content updates, effectiveness KPIs and integration with individual performance objectives, proportionate to the criticality level (L1, L2, L3).

Strategies and practices to ensure that teams, profiles and stakeholders are prepared to apply Security by Design