Security Processes And Controls

The example project follows a small set of recurring security processes: periodic access reviews, dependency vulnerability scanning, and an incident response process for handling suspected security events.

Access reviews happen quarterly. Every account and role with access to a production system is reviewed by its owning team, and access that is no longer needed is revoked as part of the same review.

Dependency scanning runs automatically on every change to the application repository, and any finding above a defined severity blocks the change from being merged until it is resolved or explicitly accepted with a documented reason.