Domain

Dev security

18 documents. Secure development lifecycle, CI/CD, and pipeline controls.

This directory holds the GRC secure-development standards: security standards, quick-reference guides, compliance registers, policies, and procedures for developers and DevOps practitioners. Content addresses secure development baseline requirements, CI/CD pipeline security, developer toolchain security, and compliance controls for software development activities. These are normative GRC artefacts of the same shape as the content of the Security and Risk domains and the other domains in the library.

Note

Its original content is released under CC BY-SA 4.0; a quotation that NOTICE.md (opens in a new tab) allows or keeps under its transition clause keeps its source licence and is not relicensed under CC BY-SA 4.0.

Policy, 1

Policies

Secure Development and Engineering Policyv1.0.22

Standard, 14

Standards

API Security Standardv0.0.14
AWS Cloud Hardening Baseline Standardv0.0.10
Azure Cloud Hardening Baseline Standardv0.0.9
Container and Image Security Standardv1.0.4
Developer Security Requirementsv1.1.40
DevOps Security Requirementsv1.0.31
Google Cloud Platform Hardening Baseline Standardv0.0.9
Jakarta EE Application Security Standardv0.0.6
Mobile Application Security Standardv1.1.8
Quality Assurance and Testing Standardv1.0.7
Security Baseline and Standards Referencev1.1.39
Security Quick Referencev1.1.32
Software Composition Analysis Standardv1.1.21
Software Evaluation, Acceptance and Lifecycle Management Standardv1.0.13

Procedure, 1

Procedures

Secure Code Review Procedurev0.0.9

Guideline, 1

Guidelines

AI Coding Assistant Security Guidelinev1.3.23

Registers

Compliance Controls and Gap Register Templatev1.0.7

Leadership, 6

Leadership pages for this area

Pages from the executive layer that tag this area. They explain and advise; the documents above govern.

What the governing body should require for secure-development governance oversightexecutive brief
What the governing body should require for third-party and AI supply-chain risk oversightexecutive brief
What the governing body should ask about enterprise architecture and accumulated technology debtoversight question set
What the governing body should ask about the organization's secure-development model, code review, dependencies, pipelines, and release qualityoversight question set
When a release-signing key is compromised after software reaches productionscenario
When an AI-suggested dependency turns out to be a malicious packagescenario

Next on the tour

Open a domain: Risk