65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
Title: Secure Development Policy
|
|
Document ID: [POL-SECDEV-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Secure Development Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's high-level requirements for integrating security into software design, development, testing, and release activities.
|
|
|
|
## Scope
|
|
|
|
This policy applies to source code, infrastructure as code, build pipelines, code review, deployment workflows, and related engineering activities within the ISMS scope.
|
|
|
|
## Objectives
|
|
|
|
- reduce security defects introduced during development
|
|
- ensure security is considered throughout the software lifecycle
|
|
- support safe and repeatable change in cloud-native environments
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Security requirements must be considered during design, development, testing, and release planning.
|
|
|
|
Changes to source code, application configuration, infrastructure definitions, and deployment pipelines must be subject to controlled review and approval.
|
|
|
|
Code changes affecting authentication, authorisation, data handling, cryptography, logging, or externally exposed services should receive additional security scrutiny.
|
|
|
|
Build and release processes must be designed to reduce the risk of unauthorised change, insecure dependencies, or unsafe deployment to production environments.
|
|
|
|
Development and test practices must be appropriate for BlackDice's cloud-native SaaS and Kubernetes-based operating model.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- Engineering leadership must ensure secure development expectations are embedded into delivery practices.
|
|
- Developers must follow approved secure coding and review requirements.
|
|
- [Role] must define supporting standards and assurance expectations.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Exceptions to required development controls must be documented, approved, and reviewed based on risk.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be monitored through code review records, pipeline assurance, vulnerability trends, incidents, and audit.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- CI/CD Security Standard
|
|
- Secure Code Review Standard
|
|
- Change Management Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|