Initial commit

01-policies/secure-development-policy.md

@@ -0,0 +1,64 @@
+Title: Secure Development Policy
+Document ID: [POL-SECDEV-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CEO (Paul Hague)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Secure Development Policy
+
+## Purpose
+
+This policy defines BlackDice's high-level requirements for integrating security into software design, development, testing, and release activities.
+
+## Scope
+
+This policy applies to source code, infrastructure as code, build pipelines, code review, deployment workflows, and related engineering activities within the ISMS scope.
+
+## Objectives
+
+- reduce security defects introduced during development
+- ensure security is considered throughout the software lifecycle
+- support safe and repeatable change in cloud-native environments
+
+## Principles / Policy Statements
+
+Security requirements must be considered during design, development, testing, and release planning.
+
+Changes to source code, application configuration, infrastructure definitions, and deployment pipelines must be subject to controlled review and approval.
+
+Code changes affecting authentication, authorisation, data handling, cryptography, logging, or externally exposed services should receive additional security scrutiny.
+
+Build and release processes must be designed to reduce the risk of unauthorised change, insecure dependencies, or unsafe deployment to production environments.
+
+Development and test practices must be appropriate for BlackDice's cloud-native SaaS and Kubernetes-based operating model.
+
+## Roles and Responsibilities
+
+- Engineering leadership must ensure secure development expectations are embedded into delivery practices.
+- Developers must follow approved secure coding and review requirements.
+- [Role] must define supporting standards and assurance expectations.
+
+## Compliance / Exceptions
+
+Exceptions to required development controls must be documented, approved, and reviewed based on risk.
+
+## Monitoring and Review
+
+This policy should be monitored through code review records, pipeline assurance, vulnerability trends, incidents, and audit.
+
+## Related Documents
+
+- Information Security Policy
+- CI/CD Security Standard
+- Secure Code Review Standard
+- Change Management Policy
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |