GRCLibrary.ai

Standard

Security Quick Reference

This quick reference condenses the most common development security questions into one page: the prohibitions and their exception requirements, the authentication, data-handling, secrets, environment, pipeline, and encryption rules, and the pre-production checklists, each pointing back to the governing standard or procedure. It is the first stop for developers, DevOps practitioners, and platform engineers; when the answer is not here, the relevant standard and then the security team are the next stops.

Type
Standard
Version
1.1.32
Date
2026-11-05
Owner
Chief Information Security Officer
Approving authority
Chief Information Officer
Classification
Public
Confidentiality
Public
Category
Developer Security
Review frequency
6 to 12 months and upon material threat, regulatory, or framework change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • 1. How to use this document
  • 2. NEVER do these things
  • 3. Authentication decision tree
  • 4. Data classification: what to do
  • 5. Secrets management reference
  • 6. Environment rules
  • 7. CI/CD pipeline gate summary
  • 8. Change management: quick reference
  • 9. Patch and vulnerability SLA: quick reference
  • 10. Encryption algorithm cheatsheet
  • 11. Application production onboarding checklist
  • 12. Production go-live security checklist
  • 13. AI development minimum checklist
  • 14. Automation workflow deployment checklist
  • 15. Customer-facing and AI feature security checklist
  • 16. Incident response: what to do
  • 17. Key reference areas

Related documents