Secure Development

Secure development lifecycle and coding practices at FMIS

Secure Development

Security is built into how FMIS systems are designed, developed, and released. This is managed through a structured development approach, supported by defined controls and aligned to recognised standards.

Development approach

FMIS follows a secure software development lifecycle (SDLC). Security is considered at each stage, from initial design through to release and ongoing maintenance.

This includes:

Defined development and review processes
Separation of development, testing, and production environments
Controlled release and version management

This structure ensures that changes are introduced in a consistent and controlled way.

Secure coding practices

Security controls are applied during development to reduce the risk of vulnerabilities.

This includes:

Input validation and output encoding
Protection against common web application risks, including those outlined in the OWASP Top 10
Use of established development frameworks and standards

These practices are applied as part of day-to-day development, not as a separate activity.

Code review and testing

Code is reviewed and tested before release to ensure both functionality and security.

Code is reviewed as part of the development process
Updates are tested in controlled environments
Releases are approved before deployment

This helps ensure that changes are stable and do not introduce unintended risks.

Vulnerability management

Security testing forms part of the development lifecycle.

Code scanning is used to identify potential issues
System-level scans are carried out on hosted environments
Findings are reviewed and resolved through defined processes

Recent scanning has confirmed that hosted environments are securely configured, with no outstanding critical issues identified following remediation.

Continuous improvement

Security is reviewed and updated over time.

Development practices are aligned with ISO 27001
Guidance from sources such as NCSC and OWASP is applied where relevant
Processes are reviewed through internal audits and external testing

This ensures that development practices remain aligned with current standards and evolving risks.

Further information

If you require additional detail on development practices or security controls, please contact:

privacy@fmis.co.uk

Secure Development