Secure Development Lifecycle and Risk Management

This set covers the security work performed throughout development, including identifying applicable requirements, analyzing threats, reviewing designs, handling dependencies and secrets, and recording risk-treatment decisions. Questions should ask about specific practices or evidence-backed conditions, rather than treating an aggregate score as a measure of risk or compliance. The general delivery process belongs to SFS 7, security test findings to SFS 9, and organizational approval authority to SFS D.

• SF 0
• SF 1
• SF 2
• SF 3
• SF 4
• SF 5
• SF 6
• SF 7
• SF 8
• SF 9
• SF A
• SF B
• SF C
• SF D
• SF E
• SF F