Skip to main content

Pro audit program · v1.0

Secure SDLC Maturity

Are security activities baked into the development lifecycle, or are they bolted on at the end? A focused maturity snapshot.

  • General target area
  • OWASP SAMM / NIST SSDF framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Are security activities baked into the development lifecycle, or are they bolted on at the end? A focused maturity snapshot.

Risks addressed

  • High Security review only at the very end u2014 costly rework
  • High No threat modelling for high-risk features
  • High Production hot-fixes bypass review entirely

Controls (6)

  1. Documented secure SDLC policy

    High

    Documented secure SDLC policy

    How to test + evidence

    Testing procedure: A short policy maps security activities to dev phases (design, code, test, deploy).

    Evidence to collect: Policy document.

  2. Threat modelling for high-risk changes

    High

    Threat modelling for high-risk changes

    How to test + evidence

    Testing procedure: New features with auth / data sensitivity have a recorded threat model.

    Evidence to collect: Threat-model samples.

  3. Security training for developers (annual)

    Medium

    Security training for developers (annual)

    How to test + evidence

    Testing procedure: Annual secure-coding training tied to top OWASP categories.

    Evidence to collect: Training records.

  4. Code review gates security findings

    High

    Code review gates security findings

    How to test + evidence

    Testing procedure: PR review explicitly flags security-impacting changes; security team optional reviewer.

    Evidence to collect: PR template + sample.

  5. Production change requires approved PR + tests

    Critical

    Production change requires approved PR + tests

    How to test + evidence

    Testing procedure: No direct prod commits; all changes go via the same review + CI gate.

    Evidence to collect: Branch protection settings.

  6. Bug-bounty or responsible-disclosure channel

    Medium

    Bug-bounty or responsible-disclosure channel

    How to test + evidence

    Testing procedure: security.txt / disclosure email published; intake workflow defined.

    Evidence to collect: security.txt + intake log.