Skip to content

E21: Documentation

Goal: The 40-document set in the brief (section 31) produced, owned and kept current. Stage 1 produced the architecture and programme core. The remainder is Stage 3.

F01: Standards (Stage 3)

E21-F01-S01: Core standards set · M · Phase 0–2

  • Scope: Secure SDLC Standard · Application Classification Standard · Security Requirements Standard · Threat Modelling Standard · Secure Architecture Standard · Security Testing Standard · Vulnerability Management Standard · SBOM Standard · Software Supply Chain Security Standard · Security Exception Standard · Evidence Management Standard · GitHub Security Baseline · Pipeline Security Standard.
  • AC: Each standard states what and why, and references catalogue controls for how it is tested. Every "shall" maps to ≥ 1 control, or is explicitly marked manual with a review cycle. Approved by the Board.

E21-F01-S02: Guides and frameworks · S · Phase 2–8

  • Scope: ASVS Implementation Guide · Cloud Security Integration Guide · Jira Integration Guide · SOC Integration Guide · Security Champions Framework (with E17) · Access Control Model.

F02: Programme and operational documents

E21-F02-S01: Programme documents · M · Phase 0

  • Scope: Business Case (with costed run estimates) · Security Strategy · Current/Target State Assessments · SAMM Assessment Methodology (extract from the Stage 1 methodology) · KPI/KRI catalogue · RAID log · Implementation roadmap (maintained).
  • Progress: all 40 brief section 31 documents exist as drafts. See the documentation index. Remaining work is approval and refinement with stakeholders, not authoring.

E21-F02-S02: Operational and privacy documents · M · Phase 1–9

  • Scope: Data Retention Policy (from ADR-017) · Incident Response Runbook · Platform Operations Runbook · DR Plan · Backup and Restore Plan · Threat Model (maintained) · Privacy / DPIA inputs (DPO review required, no compliance claimed).