simpl.
Masuk
GRC Keamanan Siber 16 butir

Secure Software Development Lifecycle (SSDLC) Review

Daftar periksa ini dalam bahasa Inggris.

Reviews security integration across the software development lifecycle, from requirements and design through testing and deployment.

NIST SSDF 800-218OWASP ASVSISO 27001:2022

PDF atau Word gratis · masukkan email Anda untuk mengunduh.

Governance & Requirements

  • Are security requirements defined and documented for new features? *
  • Are developers trained in secure coding practices? *
  • Is a secure coding standard adopted (e.g., OWASP)? *

Design

  • Is threat modeling performed for new or significantly changed systems? *
  • Are security design reviews conducted before implementation? *
  • Are secure defaults and least-privilege principles applied in the architecture? *

Implementation & Testing

  • Is static application security testing (SAST) integrated into the pipeline? *
  • Is software composition analysis (SCA) used to detect vulnerable dependencies? *
  • Is dynamic testing (DAST) or penetration testing performed before release? *
  • Is peer code review required before merging to the main branch? *

Secrets & Dependencies

  • Are secrets scanned for and blocked from source code repositories? *
  • Are software dependencies pinned and sourced from trusted registries? *
  • Is a software bill of materials (SBOM) generated for releases? *

Deployment & Maintenance

  • Is code integrity protected through signing or verified build provenance? *
  • Are production deployments gated by security checks in CI/CD? *
  • Is there a process to receive and remediate reported vulnerabilities post-release? *

Unduh daftar periksa Secure Software Development Lifecycle (SSDLC) Review lengkap

Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.