Document Version: 1.0
Date: April 1st 2024

1. Introduction

This document outlines the Software Development Life Cycle (SDLC) policy adopted by Jitbit for the development of Software as a Service (SaaS) solutions. It ensures that our development processes align with industry best practices, particularly the OWASP Top Ten, to enhance the security and reliability of our software.

2. Scope

This policy applies to all software development projects at Jitbit, specifically those related to SaaS platform development and deployment.

3. Objectives

• To establish a standard procedure for software development that integrates security from the initial stages.
• To ensure compliance with the OWASP Top Ten security risks for web applications.
• To maintain high standards of quality and security throughout the development and deployment processes.

4. Policy

4.1 SDLC Phases

• a. Requirement Analysis: Gather requirements from stakeholders, ensuring security needs are identified and planned.
• b. Design: Architect and design the solution with security as a foundational element, adhering to secure design principles.
• c. Development: Implement the design using secure coding practices, with regular code reviews to identify and mitigate security vulnerabilities.
• d. Testing: Perform comprehensive testing, including security penetration testing and vulnerability assessments, against the OWASP Top Ten vulnerabilities.
• e. Deployment: Securely deploy the application, ensuring configurations and access controls meet the required security standards.
• f. Maintenance: Continuously monitor, update, and patch the software to address new security threats.

4.2 Adherence to OWASP Top Ten

Each phase of the SDLC will specifically address risks identified in the OWASP Top Ten, with documented controls and mitigation strategies. This includes regular updates to the development and testing teams about the latest security practices and vulnerabilities.

5. Training and Awareness

All development team members will receive regular training on the OWASP Top Ten and other relevant security practices. This training will be updated annually or following significant changes in security landscapes.

6. Compliance Monitoring and Reporting

Compliance with this policy will be regularly monitored through internal audits and reviews. Non-compliance issues will be addressed promptly, and corrective actions will be documented and monitored.

7. Policy Review and Improvement

This policy will be reviewed annually or after major incidents or technological changes. Feedback from audits, incident reports, and technological advancements will be incorporated into the policy updates.