> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/security-vetting-and-technical-assurance-playbook/technical-secure-by-design-standards/secure-sdlc.md).

# Secure SDLC

### Purpose

Secure SDLC embeds security into every stage of software and system delivery.

### Lifecycle Controls

| Stage        | Required controls                                                                                                 |
| ------------ | ----------------------------------------------------------------------------------------------------------------- |
| Requirements | Security, privacy, classification, availability and resilience requirements captured in backlog and SoW.          |
| Design       | Threat model, architecture review, data flow review, identity model and risk assessment.                          |
| Build        | Secure coding standards, peer review, dependency control, secrets management and branch protection.               |
| Test         | Unit tests, integration tests, SAST, dependency scanning, IaC scanning, secrets scanning and security test cases. |
| Release      | Change approval, release notes, security evidence, rollback plan and monitoring readiness.                        |
| Operate      | Logging, vulnerability management, incident response, access review and continuous improvement.                   |

### Mandatory Engineering Controls

* protected main branch;
* pull request review;
* no secrets in repositories;
* dependency approval and vulnerability monitoring;
* SBOM where required;
* infrastructure as code review;
* automated pipeline controls;
* environment separation;
* least privilege service accounts;
* release approval and rollback evidence.

### Definition of Done

A work item is not done until:

* acceptance criteria are met;
* security criteria are met;
* tests pass;
* review is complete;
* documentation is updated;
* evidence is stored;
* residual risk is known;
* release impact is understood.