G.2.4 Security code review policy
Control Details
Objective
Guidelines on which code should undergo a security-focused manual or automated review are communicated.
Definition
The policies for whether security-focused code review (a person looks directly at the code to find issues) and security-focused code analysis (tools are used to find issues in code, either in a fully automated way or in conjunction with a person) should be conducted based upon the characteristics/criticality of the software and its stage of development. Policies are established for code and AI models developed in-house and for third-party code and AI models.
Assessment Questions
- What kind of guidelines are set in place for which code and models should be manually or automatically reviewed from a security perspective?
- How are these guidelines communicated and enforced?