• Home
  • BVSSH
  • Engineering Enablement
  • Playbooks
  • Frameworks
  • Good Reads
Search

What are you looking for?

Standard : Access is continuously verified and contextual

Purpose and Strategic Importance

This standard ensures access control is reviewed whenever system boundaries change, maintaining secure-by-design principles as systems evolve. It helps teams proactively manage risk and uphold least-privilege access.

Aligned to our "Zero Trust Architecture" policy, this standard reduces the likelihood of unauthorised access and strengthens system resilience. Without it, access models drift, vulnerabilities grow, and trust is compromised.

Strategic Impact

Clearly defined impacts of meeting this standard include improved delivery flow, reduced risk, higher system resilience, and better alignment to business needs. Over time, teams will see reduced rework, faster time to value, and stronger system integrity.

Risks of Not Having This Standard

  • Reduced ability to respond to change or failure
  • Accumulation of technical debt or friction
  • Poor developer experience and morale
  • Decreased confidence in releases and features
  • Misalignment between technical implementation and business priorities

CMMI Maturity Model

  • Level 1 – Initial: Access is based on static roles and often overly broad.

  • Level 2 – Managed: Some context-aware access controls exist but are inconsistently applied.

  • Level 3 – Defined: Zero trust principles are applied across identity, device, and network layers.

  • Level 4 – Quantitatively Managed: Access patterns are monitored and used to detect anomalies.

  • Level 5 – Optimising: Access control adapts dynamically based on real-time context and behaviour.Identity, device posture, and session context are used to validate all access attempts across services.


Key Measures

  • Adoption metrics relevant to the standard (to be defined)
  • Quality, throughput, and system health metrics aligned to capability
  • Maturity scores based on structured assessment
Associated Policies
  • Secure by Design
Associated Practices
  • Infrastructure Threat Detection
  • Policy as Code
  • Zero Trust Architecture
  • Identity Federation
  • Just-in-Time Access
  • Secret Rotation Automation
  • Software Composition Analysis (SCA)
  • Dynamic Application Security Testing (DAST)
  • Multi-Factor Authentication (MFA)
  • Secrets Management in Pipelines
  • Static Application Security Testing (SAST)
  • Vulnerability Management
Associated Measures
  • Compliance Coverage
  • Percentage of Services Scanned
  • Security Incident Response Time
  • Time to Remediate Vulnerabilities

Technical debt is like junk food - easy now, painful later.

Awesome Blogs
  • LinkedIn Engineering
  • Github Engineering
  • Uber Engineering
  • Code as Craft
  • Medium.engineering