Policy
Secure Development and Engineering Policy
This policy establishes mandatory requirements for secure software development, engineering practices, and lifecycle management across all applications, systems, and code repositories.
- Type
- Policy
- Version
- 1.0.22
- Date
- 2026-10-27
- Owner
- Chief Information Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- Annual and upon material framework or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Policy statements
- 5. Framework alignment
Frameworks it maps to
- ISO/IEC 27034 (all parts)
- ISO/IEC 27002:2022
- NIST SSDF Version 1.1
- OWASP ASVS v5
- COBIT 2019
- CSA CCM v4.1
- CSA AICM v1.1
- EU AI Act
- Treasury Board of Canada Directive on Security Management (held edition: takes effect July 1, 2019), Appendix B (mandatory procedures for information technology security control)
- Treasury Board of Canada Secretariat Security Playbook for Information System Solutions (held page: date modified 2025-10-22)
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations (held edition: V1.2, February 2020)
Related documents
- Enterprise Governance and Risk Management Policyrisk
- Software Evaluation, Acceptance and Lifecycle Management Standarddev-security
- Quality Assurance and Testing Standarddev-security
- Acceptance Into Service Policysecurity
- AI Governance and Risk Frameworkai
- Patch Management Procedureoperations
- Threat Modelling Standardsecurity
- Canada Public Sector GRC Requirements Annexcompliance
Next
All Documents