Outsourced development

Only pre-defined, authorized users are allowed to post changes to the code.

Even when development is outsourced, we remain responsible for complying with appropriate laws and verifying the effectiveness of security controls.

We have defined the procedures that we monitor and follow throughout the outsourcing chain.Practices may include e.g. the following things:

• policies for reviewing and approving generated code
• evidence of testing activities performed by the partner
• communication practices
• contractual rights to audit the development process and management tools
• documentation requirements for code generation