Compliance & Governance in SDLC Flashcards

A company's SDL requires a Coordinated Vulnerability Disclosure (CVD) policy. This policy primarily governs which aspect of the software lifecycle?

Answer: How external researchers can report vulnerabilities and how the company must respond

A CVD policy defines the process for external security researchers to responsibly report vulnerabilities and establishes the organization's response obligations and timelines.

In the context of SDL compliance, 'security debt' refers to:

Answer: Accumulated unresolved security risks deferred from earlier SDL phases

Security debt is the accumulation of unresolved vulnerabilities and skipped security controls from earlier phases that must eventually be addressed.

Which governance artifact maps each identified threat to a specific security control implemented to mitigate it?

Answer: Threat-to-control traceability matrix

A threat-to-control traceability matrix provides auditable evidence that every identified threat has a corresponding mitigating control, which is essential for compliance reporting.

Under the Common Criteria (ISO/IEC 15408) framework, an Evaluation Assurance Level (EAL) primarily represents:

Answer: The rigor and depth of security evaluation applied to a product

EAL ratings (EAL1–EAL7) define the depth and stringency of the security evaluation process, not the product's features or the number of vulnerabilities found.

An SDL program requires 'supply chain risk management' for all external dependencies. Which practice best operationalizes this requirement?

Answer: Continuously monitoring dependencies for known CVEs and requiring approval for new additions

Continuous CVE monitoring of dependencies and a formal approval process for new ones directly addresses supply chain security risk in the software development context.

A development team uses an Agile methodology. How should SDL security gates be adapted for Agile to maintain governance without blocking delivery?

Answer: Integrate security activities as Definition of Done criteria within each sprint

Embedding security activities into the Definition of Done ensures security governance is continuous and sprint-native rather than a blocking end-phase activity.

Which compliance requirement mandates that organizations maintain a vulnerability management program with defined SLAs for patching critical vulnerabilities in software?

Answer: PCI DSS Requirement 6.3

PCI DSS Requirement 6.3 specifically mandates a vulnerability management process that includes defined timeframes for patching critical vulnerabilities in bespoke and custom software.