Internal Use

System Development Lifecycle Policy

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy is to define the overarching requirements for system development lifecycle (SDLC) practices at Dispel, ensuring that systems are developed, operated, and retired in a controlled and secure manner.

1.2 Scope

This policy applies to:

• All systems developed, significantly customized, or operated by Dispel.
• All phases of the SDLC, including planning, design, implementation, testing, deployment, operation, and retirement.
• All Covered Persons involved in system development and lifecycle management.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL adopt and maintain SDLC practices that integrate security, privacy, and quality considerations throughout the lifecycle of systems.

2.3 Secondary Policy Statement

• Systems SHALL have documented SDLC processes, including secure design, development, and testing.
• Deviations from SDLC practices SHALL be documented and approved as exceptions.

3. REQUIREMENTS

3.1 SDLC Policy Governance

Objective: Govern SDLC practices across the organization.

Mandatory Activities:

1. The Policy Owner (CTO or delegate) SHALL own this policy and ensure alignment with related policies and plans.
2. SDLC policies and supporting documents (e.g., plans, standards) SHALL be reviewed at least annually and updated as needed.
3. This policy SHALL be communicated to all relevant stakeholders.

Required Outputs:

• Current SDLC policy and supporting documents.

Security Controls: NIST SP 800-53 SA-3.

3.2 SDLC Integration with Risk and Governance

Objective: Align SDLC practices with risk management and governance.

Mandatory Activities:

1. SDLC activities SHALL incorporate outputs from risk assessments, planning, and configuration/change management.
2. Program and project governance structures SHALL account for SDLC requirements and quality gates.

Required Outputs:

• Governance artifacts (e.g., charters, roadmaps) referencing SDLC requirements.

Security Controls: NIST SP 800-53 PL-1, PL-2, PM-11.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner (CTO or Delegate)

Responsibilities:

• Owns this System Development Lifecycle Policy.
• Approves SDLC standards and changes to SDLC practices.

4.2 System Owners

Responsibilities:

• Ensure systems follow SDLC practices defined in this policy and related documents.

4.3 Engineering, DevOps, and Security Leads

Responsibilities:

• Implement SDLC practices within their teams.
• Coordinate on secure design, development, and deployment practices.

5. PROCEDURES

High-level procedures for SDLC implementation are defined in the System Development Lifecycle Plan (P-System_Development_Lifecycle_Plan) and SHALL be followed by relevant teams.

6. MONITORING AND COMPLIANCE

Compliance with this policy SHALL be monitored through audits and reviews of SDLC practices and artifacts, as coordinated by the Policy Owner and Security Officer.

7. EXCEPTIONS AND WAIVERS

Exceptions to this policy SHALL be submitted in writing by the System Owner, include justification and compensating controls, and require approval from the Policy Owner (CTO).

8. DEFINITIONS

System Development Lifecycle (SDLC): A structured process encompassing all stages of system creation, operation, and retirement.

9. REFERENCES

• System Development Lifecycle Plan (P-System_Development_Lifecycle_Plan).
• System Planning Policy and Procedures.

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: SDLC Policy Cross-References

Appendix B: Additional Guidance and Examples