SSDLC policy and programme charter

SSDLC policy and programme charter

CH-01 — Purpose and commitment

[Organisation] establishes a secure software development life cycle, referred to as the SSDLC, for [scope]. Its purpose is to deliver and sustain systems that meet agreed stakeholder needs, protect the interests identified for those systems, and provide evidence that approved requirements and policy commitments have been fulfilled. The programme covers organisational decisions and engineering work from the first business need to final disposition. Software security is part of system quality, alongside the other properties required for the system to be fit for its intended use.

The sponsor is accountable for the programme mandate and resources. The programme owner maintains the operating documents and coordinates their use. System owners remain accountable for the systems assigned to them. Assignment of a task to a supplier, tool or AI service does not by itself transfer the organisation’s accountability for the decision to use its output.

CH-02 — Scope and context

The programme owner records the services, products, projects, operational systems, development environments and supporting activities included in the programme. The scope identifies the organisational boundary, interfaces with other organisations, locations of work and data processing, and the life-cycle stages covered. Existing systems enter the programme through a recorded assessment of their current state; their previous history is not retrospectively represented as having operated under this policy.

For each system, the owner records its purpose, intended users, affected people, operating environment, major dependencies and relevant obligations. Shared services and inherited controls are identified with the provider responsible for operating them. Exclusions identify both the excluded activity and the continuing interfaces or dependencies that require attention. An exclusion from this programme does not remove a contractual or legal obligation.

CH-03 — Adopted promises

The operative policy set consists of the approved versions listed in the adoption register. Each adoption decision identifies whether the organisation will perform the activity, will not perform it, or will defer it until a stated date or event. Unresolved decisions remain marked unresolved. A document downloaded into a folder, a proposed assessment result, or an unsigned meeting note does not establish that a commitment has been adopted.

For each adopted promise, the owner identifies the applicable scope, the person responsible for performing it, the authority responsible for decisions, the procedure used, and the evidence retained. The owner also identifies the schedule or event that causes the activity to occur and the assurance activity that will assess performance. These details may be maintained in linked registers rather than repeated in every policy.

CH-04 — Authority and decisions

The sponsor appoints the programme owner and confirms the authority available to system owners, project managers, risk owners and release decision-makers. Delegations state the scope, conditions and duration of the authority. Decisions outside a person’s delegation are referred to the named authority. Advice, analysis and recommendations are recorded as such until the appropriate person makes a decision.

Decision records state the question considered, available information, alternatives, affected stakeholders, decision, rationale and conditions. A dissenting view or material uncertainty is preserved with the record. Authority to develop a proposal does not imply authority to accept its risk, change the system’s purpose, or commit another organisation to an obligation. Agreed standing authorities can cover repeatable work where their scope and evidence requirements are recorded.

CH-05 — Resources and competence

The sponsor confirms a programme allocation covering staff time, training, system maintenance, assurance, incident preparation and the management of suppliers. Resource requirements are reviewed against the systems in scope and the commitments adopted. Where capacity is insufficient, the programme owner records the shortfall, its consequences, the affected promises and a decision request. The policy set is not reported as operating merely because its activities have been assigned.

Roles are assigned to named people or identified contracted services. Each role includes a contact route and continuity arrangement. A person may hold more than one role where the arrangement and any review or independence implications are recorded. Competence is established through the work required, relevant knowledge and demonstrated skills, with development actions where needed. The programme does not assume that a job title alone establishes competence.

CH-06 — Assurance and reporting

The programme owner maintains an assurance plan that measures adopted promises. Assessments identify the promise, applicable population, evidence examined, method used, result and limitations. Reports distinguish adoption, implementation, operation and effectiveness. They distinguish missing evidence from evidence of failure and from a justified conclusion that an activity was not due during the period.

The sponsor receives [reporting schedule] reports covering outstanding adoption decisions, overdue work, material risks, stakeholder concerns, assurance findings and corrective actions. Decisions on continued operation, additional resources or changed commitments are recorded. A risk acceptance does not turn a failed control into a passing control, and a deferred activity remains visible until the recorded decision is reviewed or fulfilled.

CH-07 — Maintenance and communication

The programme owner publishes the approved policy set at [repository location], communicates changes to affected participants and preserves superseded versions. Reviews occur at [schedule] and when a change in mission, system scope, obligations, threat conditions, supplier arrangements or assessment results could affect the policy set. Reviews identify the records and activities that need updating, rather than changing document dates alone.

Personnel may raise uncertainty, conflicting instructions or unworkable procedures through [contact route]. The owner records the issue and arranges a decision by the appropriate authority. Temporary directions identify their effective period and affected documents. At programme closure, the sponsor confirms remaining system responsibilities, record custody and outstanding obligations.