simpl.
로그인
사이버보안 GRC 16개 항목

Secure Software Development Lifecycle (SSDLC) Review

이 체크리스트는 영어로 제공됩니다.

Reviews security integration across the software development lifecycle, from requirements and design through testing and deployment.

NIST SSDF 800-218OWASP ASVSISO 27001:2022

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Governance & Requirements

  • Are security requirements defined and documented for new features? *
  • Are developers trained in secure coding practices? *
  • Is a secure coding standard adopted (e.g., OWASP)? *

Design

  • Is threat modeling performed for new or significantly changed systems? *
  • Are security design reviews conducted before implementation? *
  • Are secure defaults and least-privilege principles applied in the architecture? *

Implementation & Testing

  • Is static application security testing (SAST) integrated into the pipeline? *
  • Is software composition analysis (SCA) used to detect vulnerable dependencies? *
  • Is dynamic testing (DAST) or penetration testing performed before release? *
  • Is peer code review required before merging to the main branch? *

Secrets & Dependencies

  • Are secrets scanned for and blocked from source code repositories? *
  • Are software dependencies pinned and sourced from trusted registries? *
  • Is a software bill of materials (SBOM) generated for releases? *

Deployment & Maintenance

  • Is code integrity protected through signing or verified build provenance? *
  • Are production deployments gated by security checks in CI/CD? *
  • Is there a process to receive and remediate reported vulnerabilities post-release? *

Secure Software Development Lifecycle (SSDLC) Review 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.