GRCLibrary.ai

Standard

Developer Security Requirements

These requirements are design constraints that apply from the first line of code. Failure to meet them must block production promotion. For a quick-reference version, see the Security Quick Reference standard. For AI-specific security requirements, see the AI and Agentic Development Security Standard.

Type
Standard
Version
1.1.40
Date
2026-10-29
Owner
Chief Information Security Officer
Approving authority
Chief Information Officer
Classification
Public
Confidentiality
Public
Category
Developer Security
Review frequency
6 to 12 months and upon material threat, tooling, or framework change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Secure development lifecycle
  • 3. Authentication requirements
  • 4. Authorization requirements
  • 5. Secrets management
  • 6. Input validation and output encoding
  • 7. Cryptography requirements
  • 8. CORS policy
  • 9. Security testing requirements
  • 10. Dependency and open-source governance
  • 11. Secure coding practices
  • 12. AI and machine learning development requirements
  • 13. API security requirements
  • 14. Data handling in code
  • 15. Workflow automation security requirements
  • 16. Robotic process automation (RPA) security requirements
  • 17. Framework and runtime EOL: developer requirements
  • 18. Application production onboarding: security prerequisites
  • 19. Framework alignment

Frameworks it maps to

Related documents