Organisational policy that defines the requirements for code review as a security control point, including a mandatory checklist, approval criteria, reviewer roles, minimum coverage and integration with automated tools, proportional to the criticality level (L1, L2, L3).
Strategies and practices for continuously validating application security through automated, manual and offensive testing.
The single index of all security verification in SbD-ToE — activity × type × oracle × chapter × risk level — distinguishing testing (behavioural oracle) from analysis/scanning (lookup/policy oracle).
Specifics of exception management in the context of secure development - SAST, linters and code review
Secure coding practices, curation and selection of guidelines, automated validation and governance during development
Technical and process indicators for the assessment of the effectiveness of secure development controls, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Technical and operational indicators for the assessment of the effectiveness of the security testing programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Organisational policy that defines the security requirements for continuous integration and delivery pipelines, including mandatory gates, integrated scanners, environment separation, artefact signing, secrets management in the pipeline and promotion approvals, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the selection, tailoring, publication, versioning and periodic review of secure development guidelines per technology stack, including the conversion of rules into automatic linter and SAST configurations, proportional to the criticality level (L1, L2, L3).
Canonical catalogue of security requirements for the development process (DEV-001 to DEV-009), with applicability by risk level and acceptance criteria for code guidelines, linters, formal review, exception management, provenance and traceable annotations.
Complete model for validating the requirements of the SbD-ToE catalogue - principles, methods by requirement type, lifecycle moments and a detailed plan by domain with operational tag, recommended method and expected evidence.
Strategies and practices for continuously validating application security through automated, manual and offensive testing
Canonical catalogue of requirements for the security testing programme (TST-001 to TST-010), with applicability by risk level and acceptance criteria for testing strategy, SAST, DAST, findings management, regression, pentesting and auditable evidence.
Organisational policy that defines the requirements for the security testing strategy throughout the application lifecycle, including SAST, DAST, SCA, IAST, fuzzing and manual testing, with mandatory gates, finding triage SLAs and centralised management of results, proportional to the criticality level (L1, L2, L3).
Integration of security validators (SAST, secrets, IaC, containers) directly into the pipeline, with mandatory execution.
Application of static testing to source code for early detection of vulnerabilities and security flaws.