# Secure development policy

Source: https://aestech.com.au/policy-templates/#secure-development-policy
Markdown URL: https://aestech.com.au/policy-templates/secure-development-policy.md

Use for ISO 27001 A.8.25 to A.8.32, source code controls, change management, and SOC 2 change controls.

Frameworks: ISO 27001, SOC 2

Use this as a starting point only. Adapt it to your real scope, systems, legal obligations, customer commitments and operating process.

```text
1. Purpose
This policy defines how software and system changes are designed, built, tested, approved, released and monitored securely.

2. Requirements
- Security requirements must be considered during design.
- Source code repositories require MFA, least privilege, branch protection and review.
- Changes must be tracked in tickets or pull requests.
- Code review is required before merge.
- Security testing must include dependency scanning and appropriate static or dynamic testing.
- Production releases require approval and rollback planning.
- Production, test and development environments must be separated.
- Production data must not be copied into test environments unless approved and masked.

3. Evidence
Keep design reviews, tickets, pull requests, approvals, test results, release records, rollback plans, vulnerability remediation records and exceptions.
```

Full template pack: https://aestech.com.au/policy-templates/policy-pack.md