You are here: / / / Secure Development

Secure Development

Secure development lifecycle and coding practices at FMIS

FMIS Secure Development Lifecycle

Secure Development

Security is built into how FMIS systems are designed, developed, and released. This is managed through a structured development approach, supported by defined controls and aligned to recognised standards.

Security and compliance enquiries
Security & compliance

If you have questions about security, data protection, or require documentation for a review, get in touch with our team.

Email our team Privacy policy Cookie policy
General enquiries: +44 (0) 1227 773003 Mon–Fri, 9:00–17:00 (BST/GMT)

FMIS Secure Development Approach

Development approach

FMIS follows a secure software development lifecycle (SDLC). Security is considered at each stage, from initial design through to release and ongoing maintenance.

This includes:

  • Defined development and review processes
  • Separation of development, testing, and production environments
  • Controlled release and version management

This structure ensures that changes are introduced in a consistent and controlled way.

FMIS Secure Coding Practices

Secure coding practices

Security controls are applied during development to reduce the risk of vulnerabilities.

This includes:

  • Input validation and output encoding
  • Protection against common web application risks, including those outlined in the OWASP Top 10
  • Use of established development frameworks and standards

These practices are applied as part of day-to-day development, not as a separate activity.

FMIS Code Review Practices

Code review and testing

Code is reviewed and tested before release to ensure both functionality and security.

  • Code is reviewed as part of the development process
  • Updates are tested in controlled environments
  • Releases are approved before deployment

This helps ensure that changes are stable and do not introduce unintended risks.

FMIS Vulnerability Management and Testing

Vulnerability management

Security testing forms part of the development lifecycle.

  • Code scanning is used to identify potential issues
  • System-level scans are carried out on hosted environments
  • Findings are reviewed and resolved through defined processes

Recent scanning has confirmed that hosted environments are securely configured, with no outstanding critical issues identified following remediation.

FMIS Continuous Improvement

Continuous improvement

Security is reviewed and updated over time.

  • Development practices are aligned with ISO 27001
  • Guidance from sources such as NCSC and OWASP is applied where relevant
  • Processes are reviewed through internal audits and external testing

This ensures that development practices remain aligned with current standards and evolving risks.

Further information

If you require additional detail on development practices or security controls, please contact:

privacy@fmis.co.uk

G-Cloud 15 - Government Commercial Agency Supplier logo

FMIS awarded G-Cloud 15 supplier status

FMIS Asset Management Software awarded G-Cloud 15 Supplier Status for Fixed Asset Management, Lease Accounting, Asset Tracking & Equipment Maintenance software.
UK public-sector indexation

Indexation in UK Public Sector Fixed Asset Accounting

Understanding how indexation fits alongside revaluation is now essential for finance teams managing non-current assets in the public sector.
Non-Current Assets vs Fixed Assets In the UK public-sector

Why the UK Public Sector Is Moving from Fixed Assets to Non Current Assets

Why is the UK public sector shifting to non-current assets, and how does FMIS software enhance control and compliance?
SORP_Lease_Accounting_changes_2026

Preparing for Charities SORP Lease Accounting Changes 2026