This policy procedure sets out how information security is built into the life cycle of every company project, and when privacy and risk assessments are needed.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on secure development:

• ISO 27001 Annex A 8.25 - Secure Development Life Cycle
• ISO 27001 Annex A 8.28 - Secure Coding
• ISO 27001 Annex A 8.29 - Security Testing in Development and Acceptance
• ISO 27001 knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help building information security into your project management, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Secure Development Policy Procedure Template

The Secure Development Policy Procedure is a Word template that sets out how information security is built into project management, whatever the type or owner of the project. It covers development risks, security as an explicit requirement across the project life cycle, classifying project documents, privacy impact and risk assessments, and how breaches of the policy are handled.

Project documents are classified and labelled under the information classification policy procedure the file names. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of building information security into project management, the activities and staff covered, and disciplinary action for breaches
• Management of development risks - periodic risk assessments of the risks associated with development, with findings actioned and the policy kept in line with current controls
• Security across the project life cycle - information security as an explicit requirement in all company defined projects, protecting the confidentiality, integrity and availability of project information
• Classification and assessments - project documents classified and labelled, a privacy impact assessment where personal information is involved and a risk assessment where company information is accessed
• Breaches of policy - breaches treated as potential misconduct and dealt with as a disciplinary matter, with line managers as the first point for questions

Built for Security in Every Project

• Information security written into every company defined project, whatever the management methodology used
• Project information protected against breaches of confidentiality, failures of integrity and interruptions to availability
• A privacy impact assessment where a project could affect the privacy of individuals
• A risk assessment where a project involves accessing or storing company information

Who Needs a Secure Development Policy Procedure?

Businesses that run development or other internal projects involving company or personal information, and the project managers who run them.

How the Policy Fits Together

Project documents and communications holding classified, commercially sensitive or personal information are classified, handled and labelled under PP-8-12 Information Classification and Protection Policy Procedure.

Using the Policy

Edit the project types and the points at which assessments are triggered to suit the way your business runs projects, and name the person in the Controlled By field. Give it top level approval and brief project managers and staff.

Related Documents

GG-8-05 Secure Project Management and Outsourcing Guidance and TT-8-05 Secure Project Management and Outsourcing Training Talk help managers and staff put secure project management into practice.

Privacy and Risk Assessments for Projects

The nature of a project decides which assessments it needs. Where a project involves personal information or could affect the privacy of individuals, a privacy impact assessment must be carried out, and where it involves accessing or storing company information, a risk assessment must be carried out.