حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 16 بند
Secure Software Development Lifecycle (SSDLC) Review
قائمة التحقق هذه باللغة الإنجليزية.
Reviews security integration across the software development lifecycle, from requirements and design through testing and deployment.
NIST SSDF 800-218OWASP ASVSISO 27001:2022
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Governance & Requirements
- Are security requirements defined and documented for new features? *
- Are developers trained in secure coding practices? *
- Is a secure coding standard adopted (e.g., OWASP)? *
Design
- Is threat modeling performed for new or significantly changed systems? *
- Are security design reviews conducted before implementation? *
- Are secure defaults and least-privilege principles applied in the architecture? *
Implementation & Testing
- Is static application security testing (SAST) integrated into the pipeline? *
- Is software composition analysis (SCA) used to detect vulnerable dependencies? *
- Is dynamic testing (DAST) or penetration testing performed before release? *
- Is peer code review required before merging to the main branch? *
Secrets & Dependencies
- Are secrets scanned for and blocked from source code repositories? *
- Are software dependencies pinned and sourced from trusted registries? *
- Is a software bill of materials (SBOM) generated for releases? *
Deployment & Maintenance
- Is code integrity protected through signing or verified build provenance? *
- Are production deployments gated by security checks in CI/CD? *
- Is there a process to receive and remediate reported vulnerabilities post-release? *
نزّل قائمة تحقق Secure Software Development Lifecycle (SSDLC) Review كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.