Source-code ownership
Repository ownership and source-code transfer are defined in the commercial agreement. Third-party and open-source licences are identified separately.
Loading…
Security & IP
The applicable controls depend on the assignment and deployment environment. They are recorded in the delivery plan and commercial agreement.
Repository ownership and source-code transfer are defined in the commercial agreement. Third-party and open-source licences are identified separately.
Access is granted only where required for the assignment and should be revoked after handover or role changes.
Production credentials should not be stored in source code. Environment-specific secrets are handled through the agreed deployment environment.
Development, testing or staging, and production responsibilities are defined before deployment.
Confidential projects can be governed by mutually agreed confidentiality terms before sensitive access is provided.
Handover may include repository access, deployment configuration, database migration instructions, documentation and an agreed knowledge-transfer session.
Engagement boundaries
Independent testing, certification and continuous monitoring require appropriately qualified providers. When they are needed, their scope and responsibilities are agreed separately from the software-delivery engagement.
Describe the repository, environments and access involved. The applicable controls can then be written into the proposed engagement.