10 docs tagged with "SSDF"

Structured identification, analysis and mitigation of threats during the development lifecycle

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Strategies and practices for continuously validating application security through automated, manual and offensive testing.

Security practices for the definition, validation and management of infrastructure as code

Organisational policy that defines the requirements for the traceability of security practices throughout the application lifecycle, including a compliance repository per application, designation of security owners, periodic validations per SbD-ToE chapter, auditable evidence and an organisational dashboard, proportionate to the criticality level (L1, L2, L3).

Formal policies required to legitimise and operationalise the continuous validation of application security.

Organisational policy that defines the requirements for the definition, collection, analysis and reporting of security governance KPIs, including metric categories, reporting cadence, responsibilities, intervention thresholds and integration with maturity frameworks (SAMM, SSDF), proportionate to the criticality level (L1, L2, L3).

Definition, application, validation and traceability of application security requirements by risk level

Strategies and practices for continuously validating application security through automated, manual and offensive testing

Organisational policy that defines the requirements for the security training and upskilling programme, including mandatory onboarding, training tracks by profile and risk level, the Security Champions programme, practical exercises, content updates, effectiveness KPIs and integration with individual performance objectives, proportionate to the criticality level (L1, L2, L3).