UBC — AI Solutions

Audit — Dynamic Documentation Platform

Living documentation that stays in sync with engineering, cloud, AI, and compliance activity. Documents update themselves as the organization changes.

Back to library
SOP
Fresh

SOP-SDLC-03 — Secure Coding & Peer Review

Defines coding standards, secure-coding requirements, and mandatory peer review before merge.

Owner: Engineering DirectorApprover: CISOVersion: 4.2Updated: 12/12/1969

1. Purpose

Ensure code is secure, maintainable, and reviewed by qualified peers before merge.

2. Scope

All code, IaC, and configuration merged to main.

3. Definitions

  • Peer review — Structured review of a pull request by at least two qualified engineers.
  • SAST — Static Application Security Testing.

4. Roles & Responsibilities (RACI)

ActivityRACICadence
Author codeEngineerTech LeadReviewersTeamContinuous
Review PRReviewers (2+)Tech LeadSecurityTeamPer PR
Enforce merge gatesPlatform EngEngineering DirectorSecurityTeamContinuous

5. Procedure

  1. Follow the language-specific coding standard and OWASP secure-coding checklist.
  2. Every PR must pass linter, SAST, dependency scan, and unit tests.
  3. At least two approvals from qualified reviewers are required; PHI or auth changes require a Security reviewer.
  4. Merge to main is squashed with a signed commit message including the ticket ID.
  5. Post-merge, artefacts are built and stored per SOP-SDLC-04.

6. Inputs & Outputs

Inputs

  • Design
  • Coding standards
  • Security checklist

Outputs

  • Merged PR
  • Signed commit
  • Build artefact

7. Controls & Metrics

MetricTarget
PRs merged without required approvals0
Critical SAST findings in main0

8. Exceptions & Escalation

  • Break-glass merges require CISO approval and are back-reviewed within 24 hours.

9. Records & Retention

RecordRetention
PR history & reviews7 years (git history)
Merge gate logs3 years

10. Related Documents

  • SOP-SDLC-04
  • SOP-SDLC-06
  • Secure Coding Guide

11. References

  • ISO 27001 A.14.2
  • OWASP ASVS L2
  • CMMI-DEV TS

12. Revision History

See the Versions tab for the full change history maintained by the Auto-Doc Engine.

Document code: SOP-SDLC-03 · Aligned to OWASP ASVS L2 / ISO 27001 A.14.2. Controlled document — reproduction outside the UBC QMS requires the Quality Manager's approval.

Suggested by AI
No suggestions right now.
Frameworks
ISO 27001
SOC 2
CMMI-DEV