DEV-01 Policies for the development/procurement of information systems
Issue secure development policies covering the whole service lifecycle and grounded in recognised standards, addressing security in requirements, design, implementation, testing and verification, in software deployment i
4
artefacts
0
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Secure development policy naming the standard or method it is built on · Policy repository / GRC workspace
- Lifecycle description running from requirements through to operational vulnerability handling · Policy repository / GRC workspace
- Deployment security instruction covering the continuous delivery route · Policy repository / GRC workspace
- Proof that the policy was issued to internal developers and contracted development staff · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Policy stops at coding conventions and is silent on deployment and operation
- Delivery pipelines run under no documented security requirement at all
- No recognised standard underpins the policy, so its completeness cannot be judged
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCRY-04 Secure key management · DEV-02 Outsourcing of the development