Secure Development

Purpose

Secure development ensures that security is built into delivery rather than added at the end.

Secure Development Practices

Teams should use:

• secure coding practices

• code review

• dependency scanning

• secrets management

• least privilege access

• secure configuration

• logging and monitoring

• vulnerability management

• threat modelling where appropriate

• security testing before release

Security Evidence

Projects should retain:

• security requirements

• threat model

• access control record

• vulnerability scan results

• penetration test results where applicable

• remediation records

• risk acceptance records