Secure Development Lifecycle Policy
Sets the security requirements Your Organization applies from design through release and retirement of the software it builds, buys, or commissions: requirements, review, testing, environment separation, and dependency control.
Maps to ISO/IEC 27001:2022 A.8.25 · ISO/IEC 27001:2022 A.8.28 · ISO/IEC 27001:2022 A.8.29 · ISO/IEC 27001:2022 A.8.31 · FedRAMP Moderate SA-3 · FedRAMP Moderate SA-8 · FedRAMP Moderate SA-11 · SOC 2 Type II CC8.1
Read it now — the PDF opens either way.
Purpose
Your Organization builds, configures, and operates software that handles customer and company information. This policy sets the security activities that must happen at each stage of the development lifecycle so that defects are prevented early, found before release, and fixed on a known timeline, rather than discovered in production.
Scope
This policy applies to all software that Your Organization develops, customizes, or commissions from a third party, including applications, APIs, infrastructure as code, build and deployment pipelines, scripts that touch production data, and internally developed tooling. It applies to every engineer, contractor, and vendor who contributes code. Off-the-shelf software that Your Organization only configures is governed by the Vendor Risk Management Policy and the Change Management Policy.
6 more sections in the full template
Roles and responsibilities · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Secure Development Lifecycle Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.