Secure SDLC Scorecard

How often do you use an automated static scanner like Puma Scan, Checkmarx, Veracode, or Fortify in your SDLC? Every release
Once a month
Once a quarter
Once a year
Never

How often do you use an automated dynamic scanner like AppScan, WebInspect, Whitehat, etc.? Every release
Once a month
Once a quarter
Once a year
Never

How often do you perform manual dynamic reviews? Every release
Once a month
Once a quarter
Once a year
Never

How often do you perform manual static reviews? Every release
Once a month
Once a quarter
Once a year
Never

Do you have a Security Champion program? Yes
No Do you have an in-house application security specialist who regularly assists throughout the SDLC? Yes
No

How often is your development team trained in Secure Application architecture, design and development? Never
Once a year
Once every two years
Every 2-3 years

How often do you hold refresher courses? Never
Once a quarter
Once a month
On demand

How often do you conduct threat modeling? What is Threat Modeling?
Every Release
Semi-Annually
Annually