Engineering Security Program Overview

Document Type: Program Overview / Engineering Governance
Owner: Engineering Lead
Applies To: All engineering contributors (employees and contractors)
Effective Date: 07 Jan 2026 
Review Frequency: Annual (or upon significant system/architecture changes)
Version: 1.0

1. Purpose

This document provides an overview of Vertuna’s Engineering Security Program and explains how security and privacy controls are embedded into engineering practices. The program is designed to ensure that systems are built and operated securely using lightweight, repeatable processes that are suitable for a small engineering organization while aligning with widely accepted industry practices and audit expectations.

2. Program Scope

The Engineering Security Program applies to all engineering activities related to Vertuna systems, including:

• application development (web and APIs)

• infrastructure and cloud configuration

• CI/CD pipelines and deployment automation

• identity and access management

• monitoring, logging, and alerting

• vulnerability management and remediation

• data processing and storage workflows

• incident response and security event handling

This program covers both production and non-production environments.

3. Security and Privacy-by-Design Foundations

Vertuna’s program is centered on two foundational principles:

1. Secure-by-design: systems are designed to minimize attack surface, enforce secure defaults, apply least privilege, use defense in depth, and fail securely.

2. Privacy-by-design: privacy is treated as a default requirement, embedded in architecture decisions, supported end-to-end across the lifecycle, and aligned with user-centric expectations.

These principles are formally defined in the document Engineering Security & Privacy-by-Design Principles and apply to all implementation efforts.

4. Security Governance Model (Lightweight and Practical)

Vertuna’s governance approach is designed for a small engineering team while remaining consistent and auditable.

Roles and Responsibilities

• Engineering Lead

  • Owns engineering security standards and policies

  • reviews and approves high-risk changes

  • coordinates incident response

  • ensures security controls remain effective and aligned with business needs

• All Engineers

  • implement secure coding and secure configuration practices

  • complete peer review duties

  • respond to remediation tasks

  • escalate security concerns and suspected incidents immediately

Review Cadence

• Policies and standards are reviewed at least annually.

• High-impact operational changes trigger a targeted review of relevant documents and controls.

5. Engineering Security Control Domains

Vertuna organizes its controls into the following domains. Each domain is supported by specific processes, standards, and evidence artifacts.

5.1 Secure Software Development Lifecycle (SDLC)

Security is embedded into development workflows, including:

• code reviews and approval gates

• automated scanning (static and dependency scanning)

• separation of production and non-production environments

• secure data handling practices

References

• SDLC & Application Security Policy

• Engineering Security & Privacy-by-Design Principles

Evidence

• pull request approvals and review logs

• automated build and scan results

• documented change impact notes (PR description)

5.2 Change Management and Approval Controls

Production-impacting and significant changes follow a structured workflow:

• peer review required

• Engineering Lead approval required for significant/high-risk changes

• emergency change handling includes retrospective review

References

• Significant Code Change Review & Approval Process

• Change Management Policy

Evidence

• PR approval history

• deployment logs or release notes

• emergency change retrospective notes

5.3 Access Control and Privileged Access Governance

Vertuna enforces least privilege and restricts production access to approved administrators. Access is reviewed periodically and revoked promptly when no longer required.

References

• Access Control Policy

• Segregation of Duties Policy

Evidence

• access grant records (where applicable)

• periodic access review confirmations

• account deactivation records

5.4 Vulnerability and Patch Management

Vertuna manages vulnerabilities via:

• external vulnerability scanning for internet-facing systems

• dependency scanning integrated into the development workflow

• timely remediation based on severity

• ongoing patching for OS and infrastructure

References

• Vulnerability Management Policy

• Patch Management Policy

Evidence

• scan reports and findings

• tickets/PRs linked to remediation work

• dependency update history

5.5 Encryption and Secure Data Handling

Vertuna protects sensitive data through:

• encryption in transit (TLS 1.2+)

• encryption at rest using modern algorithms

• secure key storage and restricted access

• planned improvements such as key rotation

References

• Encryption & Cryptographic Controls Policy

• Engineering Security & Privacy-by-Design Principles

Evidence

• configuration of TLS endpoints

• database encryption configuration notes

• encryption implementation references in code/config

5.6 Logging, Monitoring, and Security Event Detection

Vertuna maintains logging coverage for:

• authentication events

• system and application errors

• operational security signals

• monitoring for suspicious patterns and abuse

References

• Logging & Monitoring Policy

Evidence

• log retention configuration

• monitoring dashboards and alerts

• incident investigation notes when applicable

5.7 Incident Response

Vertuna maintains an internal incident response workflow that includes:

• detection and triage

• investigation and containment

• remediation and recovery

• notification and reporting obligations

• incident documentation and retrospective improvements

References

• Incident Response Policy

Evidence

• incident reports and root-cause notes

• remediation PRs/tickets

• customer or partner notifications when required

5.8 Privacy Impact and Data Minimization

Vertuna applies privacy-by-design and data lifecycle protection by:

• limiting collection to necessary data

• applying encryption and access controls

• enforcing retention boundaries

• supporting deletion and secure disposal processes

• documenting sensitive data processing and flows

References

• Privacy Impact Checklist (Lightweight)

• Engineering Security & Privacy-by-Design Principles

• Secure Disposal & Media Sanitization Policy

Evidence

• completed privacy impact checklists for relevant features

• documented data flows in design notes

• deletion and retention configuration references

6. Engineering Security Review Mechanisms

The program includes the following review mechanisms to ensure consistent application:

1. Peer Review and Approval

   • required for all significant changes

   • reviewers confirm security and privacy principles were applied

2. Secure-by-Design Engineering Review Checklist

   • used as a release gate for significant changes

   • documents secure-by-design and privacy-by-design verification

3. Privacy Impact Checklist

   • required for changes that introduce or modify personal/customer data processing

4. Engineering Lead Review for High-Risk Changes

   • required for production-impacting or security-sensitive modifications

7. Program Documentation and References

Vertuna maintains an Engineering Security Standards Library. Key documents include:

• Engineering Security & Privacy-by-Design Principles

• Significant Code Change Review & Approval Process

• Secure-by-Design Engineering Review Checklist

• Privacy Impact Checklist

• SDLC & Application Security Policy

• Access Control Policy

• Segregation of Duties Policy

• Vulnerability Management Policy

• Patch Management Policy

• Encryption & Cryptographic Controls Policy

• Logging & Monitoring Policy

• Incident Response Policy

• Third-Party Risk Management Policy

• Secure Disposal & Media Sanitization Policy

• Environment Segregation Policy

• Endpoint Security & Removable Media Policy

The complete list and document linkage is maintained in the Engineering Security Standards Index.

8. Exceptions and Compensating Controls

Exceptions to standards may be granted only when:

• there is a documented business or technical justification

• compensating controls are identified

• the Engineering Lead approves the exception

• the exception is reviewed periodically until it is resolved or removed

Evidence of exceptions and approvals must be retained (e.g., in issue tracking or documented PR notes).

9. Review and Maintenance

This program overview and all supporting documents are reviewed:

• annually, and

• after significant architectural change, major incidents, or new compliance requirements

Changes are approved by the Engineering Lead and communicated to engineering contributors.

10. Document Control