Secure SDLC Policy

Document control

Field	Value
Document status	Active policy document
Owner	Security / Operations
Approver	Management
Review frequency	Annual or on material change
Classification	Customer-shareable

Purpose

Integrate security into software design, development, review, testing, release, and maintenance.

Scope

This policy applies to custom applications, integrations, scripts, APIs, infrastructure-as-code, deployment pipelines, and configuration changes.

Secure requirements

Security and privacy requirements should be considered during planning, including authentication, authorization, data handling, logging, error handling, rate limiting, input validation, retention, and integration security.

Development practices

Developers must avoid hardcoded secrets, validate input, enforce server-side authorization, use secure framework APIs, protect sensitive logs, handle errors safely, and follow least-privilege design.

Code review

Material changes must be reviewed before merge. Reviews should cover business logic, authorization, data exposure, injection risks, dependency changes, secrets, performance, and migration impact.

Testing and scanning

Security testing may include unit tests, manual review, dependency scanning, SAST/DAST where available, API testing, and regression testing for remediated findings.

Release and maintenance

Deployments should follow change control, rollback planning, monitoring, and post-deployment validation. Vulnerabilities discovered after release must follow the vulnerability management process.

Evidence to maintain

Requirement notes, design review, pull/merge requests, test results, scan output, release notes, and remediation records.