{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","download":{"releaseId":"sha256:03f26b6de99841801f9e1ea89f8e0aae1de6fdc3dfbafb66e4e9d22bdda9709b","slug":"controls-secure-sdlc-phase-gate-program","url":"/assets/agent_workflow-controls-secure-sdlc-phase-gate-program-21fe0d97.17f577ad322e9bb5.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-secure-sdlc-phase-gate-program","description":"Operate the secure SDLC phase-gate program as a modular, decision-aware workflow where the accountable control owner chairs the intake, requirements, design, and build/release gates end to end. Each recurring operating cycle runs as a new workflow instance attached to the existing secure-SDLC phase-gate Control item (domains = secure_development_sdlc; framework = nist-800-53 / iso-27001 / cobit-2019 / nist-csf-2) — that Control already exists in the library, so the instance enriches it with this cycle's gate evidence rather than creating a duplicate control. In scope: chairing those four security-integrated lifecycle gates for every development initiative due this cycle, remediating held or blocked initiatives, and monitoring the process itself; it is self-initiating and consumes no upstream workflow package, and it seeds its own next cycle. Out of scope and distinct from it: the independent SDLC gate review's release-milestone verification, and the release-security-gate's technical testing practice.","details":{"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-secure-sdlc-phase-gate-program","capabilities":[],"controls":["UC-SDLC-01","UC-SDLC-02","UC-SDLC-03","UC-SDLC-04","UC-SDLC-05"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:03f26b6de99841801f9e1ea89f8e0aae1de6fdc3dfbafb66e4e9d22bdda9709b","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-secure-sdlc-phase-gate-program","standards":["nist-800-53","iso-27001","cobit-2019","nist-csf-2"],"teams":["it"]},"download":{"releaseId":"sha256:03f26b6de99841801f9e1ea89f8e0aae1de6fdc3dfbafb66e4e9d22bdda9709b"},"history":{"digest":"1d266c83e152a5e5ddcfeb585b58eff1bb603403b9cd0b04d5b67708171e46ef","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-10-04T21:48:26Z","updatedRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4"},"id":"wf:C61","mapUrl":"https://evidenceflows.com/?v=1&node=wf%3AC61","slug":"controls-secure-sdlc-phase-gate-program","sourceIds":["aiuc-1","cobit-2019","eu-ai-act","iso-27001","nist-800-53","nist-csf-2","sox"],"sourceUrl":null,"title":"Secure SDLC Phase-Gate Program","type":"workflow"},"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:715a57945aa72a2b45f0aa7218fe3496372c12ccbc997becdf17b236c50a41a3","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","targetId":"uc:UC-SDLC-05","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:73e5eb104c34015f296fb63ac2bb2008560ecd65505cd3f79c671885506fe803","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","targetId":"uc:UC-SDLC-04","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:842d320169c78464c73b5c4c22faf3a988631ca04ad2c2c6d9c4f40eee4395af","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","targetId":"uc:UC-SDLC-03","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9aa966bdf4331a61eba1afa9b6417fa3df8ef15398b836d96f846a6cf9c8c62d","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","targetId":"uc:UC-SDLC-02","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:df229cbae774092024579a9579007487113fd5017f9159cb45454c685dc346f6","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-01-b3583fd1.json","targetId":"uc:UC-SDLC-01","type":"operates"}],"schemaVersion":1}