Scribd Logo
Upload

Welcome to Scribd!

  • 224 views

    Secure Development Policy

    Uploaded by

    Adaa Jarso
    This document outlines ABC Ventures Ltd's secure development policy. The policy applies to all internal and external engineers and developers working on ABC's business critical and confidential software and infrastructure. It describes rules for acquiring and developing software, including requiring formal change control procedures, software version control, security testing, acceptance testing, and protecting test data. Exceptions must be approved by the Head of Engineering, and violations can result in disciplinary action.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Secure Development Policy

    Uploaded by

    Adaa Jarso
    224 views4 pages
    This document outlines ABC Ventures Ltd's secure development policy. The policy applies to all internal and external engineers and developers working on ABC's business critical and confidential software and infrastructure. It describes rules for acquiring and developing software, including requiring formal change control procedures, software version control, security testing, acceptance testing, and protecting test data. Exceptions must be approved by the Head of Engineering, and violations can result in disciplinary action.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document outlines ABC Ventures Ltd's secure development policy. The policy applies to all internal and external engineers and developers working on ABC's business critical and confidential software and infrastructure. It describes rules for acquiring and developing software, including requiring formal change control procedures, software version control, security testing, acceptance testing, and protecting test data. Exceptions must be approved by the Head of Engineering, and violations can result in disciplinary action.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    224 views4 pages

    Secure Development Policy

    Uploaded by

    Adaa Jarso
    This document outlines ABC Ventures Ltd's secure development policy. The policy applies to all internal and external engineers and developers working on ABC's business critical and confidential software and infrastructure. It describes rules for acquiring and developing software, including requiring formal change control procedures, software version control, security testing, acceptance testing, and protecting test data. Exceptions must be approved by the Head of Engineering, and violations can result in disciplinary action.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 4

    Secure Development Policy

    Version 1.0

    Policy Owner: Compliance


    Effective Date: Jan 31, 2022

    1. Purpose
    To ensure that information security is designed and implemented within the development
    lifecycle for applications and information systems.

    2. Scope
    All ABC Ventures Ltd, (dba ABC ) applications and information systems that are business
    critical and/or process, store, or transmit Confidential data. This policy applies to all internal and
    external engineers and developers of ABC software and infrastructure.

    3. Policy
    This policy describes the rules for the acquisition and development of software and systems that
    shall be applied to developments within the ABC organization.

    4. System Change Control Procedures


    Changes to systems within the development lifecycle shall be controlled by the use of formal
    change control procedures. Change control procedures and requirements are described in the
    ABC Operations Security Policy.
    Significant code changes must be reviewed and approved by the Head of Engineering before
    being merged into any production branch in accordance with the Check In Process found here:
    https://app.travis-ci.com/github/wireless-table

    6. Software Version Control


    All ABC software is version controlled and synced between contributors (developers). Access to
    the central repository is restricted based on an employee’s role. All code is written, tested, and
    saved in a local repository before being synced to the origin repository.

    7. Technical Review of Applications after Operating


    Platform Changes
    When operating platforms are changed, business critical applications shall be reviewed and
    tested to ensure that there is no adverse impact on organizational operations or security.

    8. Restrictions on Changes to Software Packages


    Modifications to third-party business application packages shall be discouraged, limited to
    necessary changes and all changes shall be strictly controlled.

    9. Secure System Engineering Principles


    Principles for engineering secure systems shall be established, documented, maintained and
    applied to any information system implementation efforts.
    Engineering style guides and technical references can be found in the Development Process
    pages here: https://github.com/wireless-table/hkg/blob/master/frontend.md and
    https://github.com/wireless-table/hkg/blob/master/README.md
    Software developers are expected to adhere to ABC ’ coding standards throughout the
    development cycle, including standards for quality, commenting, and security.

    10. Secure Development Environment


    ABC shall establish and appropriately protect secure development environments for system
    development and integration efforts that cover the entire system development life cycle.

    11. System Security Testing


    Testing of security functionality shall be carried out during development. No code shall be
    deployed to ABC production systems without documented, successful test results.

    12. System Acceptance Testing


    Acceptance testing programs and related criteria shall be established for new information
    systems, upgrades and new versions.
    Prior to deploying code, a Release Checklist MUST be completed which includes a checklist of
    all Test Plans which show the completion of all associated tests.

    13. Protection of Test Data


    Test data shall be selected carefully, protected and controlled. Confidential customer data shall be
    protected in accordance with all contracts and commitments. Customer data shall not be used for
    testing purposes without the explicit permission of the data owner and the Head of Engineering.

    14. Acquisition of Third-Party Systems and Software


    The acquisition of third-party systems and software shall be done in accordance with the
    requirements of the ABC Third-Party Management Policy.

    15. Exceptions
    Requests for an exception to this Policy must be submitted to the Head of Engineering for
    approval.

    16. Violations & Enforcement


    Any known violations of this policy should be reported to the Head of Engineering. Violations
    of this policy can result in immediate withdrawal or suspension of system and network privileges
    and/or disciplinary action in accordance with company procedures up to and including
    termination of employment.

    Version
    Date
    Description
    Author
    Approved by
    1.0
    31-Jan-2022
    First Version
    SVP, Compliance
    Chief Compliance Officer

    You might also like