diff --git a/i18n/en/docusaurus-plugin-content-docs/current/checklist.md b/i18n/en/docusaurus-plugin-content-docs/current/checklist.md index 898162f..ca5fc40 100644 --- a/i18n/en/docusaurus-plugin-content-docs/current/checklist.md +++ b/i18n/en/docusaurus-plugin-content-docs/current/checklist.md @@ -12,6 +12,7 @@ Not all points are relevant in all projects, nor is it always desirable to imple Download the checklist and implement it as part of the source code in your project! ## Plan + 1. Responsibility Distribution: Is it clear what responsibility we have in the delivery, and is other responsibility clearly distributed? Is there a risk of confusion about responsibility in the future, for example, in connection with security incidents? * If Bouvet hosts the solution on behalf of the customer, it falls under our ISO 27001 certification. * This means that the delivery team has some additional responsibility for information security. Refer to SOA for further information. @@ -50,6 +51,7 @@ Download the Is it clear what security requirements apply to the solution? 1. Standard requirements 2. Customer requirements @@ -72,6 +74,7 @@ Download the What is the need for skill development within the team, and is there a plan for how this will be handled? ## Develop + 1. Are the development environments well described? 1. Are dedicated dev servers/dev boxes, laptops, others used? * Does the team have a contact point with the supplier of these? @@ -88,7 +91,7 @@ Download the Does the application require third-party software that the team must manage? E.g., web servers, messaging services, other types of server components? 1. Does the team have a routine for keeping these updated? 2. Are these included in any threat assessments? -7. Does the team have a routine for security testing, or is this validated in other ways? +7. Does the team have a routine for security testing, or is this validated in other ways? 1. SAST 2. DAST 8. How does the team handle documentation? @@ -97,6 +100,7 @@ Download the How is the solution built and deployed? 1. When using pipelines, are these subject to the same regime as the application code in terms of change management? 2. Does the team have a relationship with securing the build environment? @@ -104,6 +108,7 @@ Download the Is penetration testing planned in connection with deployment? ## Manage + 1. Has the team verified that the network diagram is correctly implemented? 1. That expected ports are open to specified IP addresses 2. That there are no unexpected or unnecessary ports or services exposed?