SDL Compliance & Governance in SDLC 4 — Questions and Answers
Question 1: In a heavily regulated industry, a new SDL policy requires every microservice to pass a security review before deployment. A team argues this slows releases unacceptably. The best governance response is to:
- Define risk-tiered review tracks where lower-risk services use lighter-weight automated checks (Correct answer)
- Exempt microservices from the policy entirely
- Increase the size of the security review team to match velocity
- Replace security reviews with developer self-attestation only
Correct answer: Define risk-tiered review tracks where lower-risk services use lighter-weight automated checks
Risk-tiered review tracks balance compliance rigor with delivery speed by applying appropriate scrutiny proportional to each service's risk profile.
Question 2: Which metric is most useful for demonstrating SDL compliance maturity to an executive steering committee?
- Mean time to remediate critical security findings across the SDLC (Correct answer)
- Number of unit tests written per sprint
- Total lines of code delivered
- Number of security tools licensed
Correct answer: Mean time to remediate critical security findings across the SDLC
Mean time to remediate critical findings directly measures how effectively the organization identifies and resolves security risk, which is the core outcome of SDL maturity.
Question 3: A compliance officer discovers that developers are skipping threat modeling to meet sprint deadlines. The most effective corrective governance action is to:
- Make threat modeling a mandatory gate with sign-off before Design phase exit (Correct answer)
- Add threat modeling training to onboarding only
- Document the exception and review it quarterly
- Replace threat modeling with automated SAST scanning
Correct answer: Make threat modeling a mandatory gate with sign-off before Design phase exit
Making threat modeling a hard gate with required sign-off enforces compliance at the process level rather than relying on developer discretion under schedule pressure.
Question 4: Under GDPR's 'Privacy by Design' principle, privacy controls should be integrated into software at which SDL stage?
- Requirements and Design (Correct answer)
- Testing only
- Deployment
- Post-launch monitoring
Correct answer: Requirements and Design
Privacy by Design mandates that privacy controls be proactively built in during Requirements and Design, not added reactively after the system is built.
Question 5: An SDL governance program introduces 'Security Champions' in each development team. Their primary role is to:
- Act as the security team's liaison within the dev team and promote security practices day-to-day (Correct answer)
- Perform formal penetration tests on the product
- Sign off on all security exceptions independently
- Replace the central security team's code review function
Correct answer: Act as the security team's liaison within the dev team and promote security practices day-to-day
Security Champions embed security culture within teams by bridging the gap between central security teams and developers, not by replacing either function.
Question 6: A software vendor selling to US federal agencies must attest to their SDL practices via which mechanism introduced by Executive Order 14028?
- Self-attestation form conforming to CISA guidance on SSDF practices (Correct answer)
- FedRAMP ATO authorization
- SOC 2 Type II report
- ISO 27001 certification
Correct answer: Self-attestation form conforming to CISA guidance on SSDF practices
EO 14028 and subsequent CISA guidance require software vendors to submit self-attestation forms confirming their software development practices align with the SSDF.
Question 7: Which SDL governance document defines the minimum set of security activities that MUST be completed for every product release, regardless of risk level?
- Security Development Lifecycle Policy (SDL baseline) (Correct answer)
- Product roadmap
- Sprint retrospective report
- Security incident playbook
Correct answer: Security Development Lifecycle Policy (SDL baseline)
The SDL Policy establishes the non-negotiable baseline of security activities required for every release, with risk-based additions layered on top.
SDL Compliance & Governance in SDLC 4
In a heavily regulated industry, a new SDL policy requires every microservice to pass a security review before deployment.
A team argues this slows releases unacceptably.
The best governance response is to: