IaaS or PaaS service provider security controls are validated to ensure that they meet business requirements in their domains of the shared security model.

Does your Development Teams follow a consistent set of Secure Coding Best practices including OWASP Coding Rules?

Are Coding standards enforced in CI/CD Pipeline using automated tools and scanning?

Are code Reviews done as a part of the Software Development Lifecycle? Before code is pushed to master or Ready for Release is it reviewed?

Do you use automated code scanning tools in pipeline based on compliance requirements such as PCI DSS?

Do you provide feedback lessons learnt from previous security incidents to teams (eg. exploited bugs and flaws)

At what stage in your development process your organisation embedded security controls and testing.

Have you incorporated threat-modelling processes in your DevSecOps in order to get your developers thinking about their software from the perspective of the attacker?

Are you allocating the time and investment needed to train your development team on secure coding?

Common security components such as identity, authorization, key management, audit/log, cryptography, protocols, etc. are maintained, published, readily available and used within module development.

Binary artifacts are digitally signed and stored in secure repositories.

A software version management system is used to manage versions of all changes to source code, executable images and tools used to create and test the software.

Does your Release regression tests include security tests?

Test results that indicate possible security concerns are tagged for security analysis.

An accurate inventory of all software packages and version information is documented via infrastructure as code. Automated detection is used to identify whether any of the packages have known CVEs associated and define specific remediation actions.

If Containers are used for deployment, images are scanned for security issues automatically in Pipeline and fixed based on CVEʼs Score.