How to answer 'Do you follow a secure software development lifecycle?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
Mention specific control gates: mandatory peer code reviews, automated CI/CD static analysis (SAST/dependency checking), branch protection rules, and environment segregation (dev/staging/prod). Reviewers look for automated enforcement over voluntary guidelines.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · APP-02
Yes. All code changes require branch protection passing automated SAST and dependency scans, plus at least one peer approval, before deployment via automated CI/CD pipelines (SOC 2, CC8.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default