SFS 8: Secure Development Lifecycle and Risk Management
Assess how security requirements, secure coding, threat analysis, and risk decisions are integrated into software engineering.
Scope and boundaries
This set covers the security work performed throughout development, including identifying applicable requirements, analyzing threats, reviewing designs, handling dependencies and secrets, and recording risk-treatment decisions. Questions should ask about specific practices or evidence-backed conditions, rather than treating an aggregate score as a measure of risk or compliance. The general delivery process belongs to SFS 7, security test findings to SFS 9, and organizational approval authority to SFS D.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0080 |
| 1 | SF 1 | 0081 |
| 2 | SF 2 | 0082 |
| 3 | SF 3 | 0083 |
| 4 | SF 4 | 0084 |
| 5 | SF 5 | 0085 |
| 6 | SF 6 | 0086 |
| 7 | SF 7 | 0087 |
| 8 | SF 8 | 0088 |
| 9 | SF 9 | 0089 |
| A | SF A | 008A |
| B | SF B | 008B |
| C | SF C | 008C |
| D | SF D | 008D |
| E | SF E | 008E |
| F | SF F | 008F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.