Cybersecurity GRC 16 items
Secure Software Development Lifecycle (SSDLC) Review
Reviews security integration across the software development lifecycle, from requirements and design through testing and deployment.
NIST SSDF 800-218OWASP ASVSISO 27001:2022
Free PDF · enter your email to download.
Governance & Requirements
- Are security requirements defined and documented for new features? *
- Are developers trained in secure coding practices? *
- Is a secure coding standard adopted (e.g., OWASP)? *
Design
- Is threat modeling performed for new or significantly changed systems? *
- Are security design reviews conducted before implementation? *
- Are secure defaults and least-privilege principles applied in the architecture? *
Implementation & Testing
- Is static application security testing (SAST) integrated into the pipeline? *
- Is software composition analysis (SCA) used to detect vulnerable dependencies? *
- Is dynamic testing (DAST) or penetration testing performed before release? *
- Is peer code review required before merging to the main branch? *
Secrets & Dependencies
- Are secrets scanned for and blocked from source code repositories? *
- Are software dependencies pinned and sourced from trusted registries? *
- Is a software bill of materials (SBOM) generated for releases? *
Deployment & Maintenance
- Is code integrity protected through signing or verified build provenance? *
- Are production deployments gated by security checks in CI/CD? *
- Is there a process to receive and remediate reported vulnerabilities post-release? *
Download the full Secure Software Development Lifecycle (SSDLC) Review checklist
Get it as a clean, printable PDF — free.