Secure SDLC

Purpose

Secure SDLC embeds security into every stage of software and system delivery.

Lifecycle Controls

Stage	Required controls
Requirements	Security, privacy, classification, availability and resilience requirements captured in backlog and SoW.
Design	Threat model, architecture review, data flow review, identity model and risk assessment.
Build	Secure coding standards, peer review, dependency control, secrets management and branch protection.
Test	Unit tests, integration tests, SAST, dependency scanning, IaC scanning, secrets scanning and security test cases.
Release	Change approval, release notes, security evidence, rollback plan and monitoring readiness.
Operate	Logging, vulnerability management, incident response, access review and continuous improvement.

Mandatory Engineering Controls

• protected main branch;

• pull request review;

• no secrets in repositories;

• dependency approval and vulnerability monitoring;

• SBOM where required;

• infrastructure as code review;

• automated pipeline controls;

• environment separation;

• least privilege service accounts;

• release approval and rollback evidence.

Definition of Done

A work item is not done until:

• acceptance criteria are met;

• security criteria are met;

• tests pass;

• review is complete;

• documentation is updated;

• evidence is stored;

• residual risk is known;

• release impact is understood.