Purpose
This document establishes the requirements for integrating information security into all projects at Carriyo, regardless of type or size. Security must be considered from project initiation through delivery and into operational handover to ensure that new systems, applications, services, and changes do not introduce unacceptable risks to Carriyo's information assets. This policy supports ISO 27001:2022 Annex A control A.5.8 (Information security in project management).
Scope
This policy applies to all projects undertaken by or on behalf of Carriyo, including:
- Software development projects (new features, platform enhancements, new services)
- Infrastructure projects (cloud migrations, architecture changes, new environment provisioning)
- Third-party integration projects (new carrier integrations, customer onboarding, SaaS tool adoption)
- Process improvement projects that affect information handling or security controls
- Vendor or supplier changes that affect data processing
This policy does not apply to minor operational tasks or bug fixes that do not change the security posture. The Change Management Policy (CAR-ISMS-POL-010) governs routine changes.
Security Assessment at Project Initiation
Security Impact Assessment
Every project must undergo a security impact assessment at initiation. The assessment determines the project's security relevance and the level of security involvement required throughout the project lifecycle.
Assessment Questions
The following questions are evaluated by the project lead in consultation with the Information Security Specialist:
- Data handling — Will the project involve new types of data, new data sources, or changes to how existing data is processed, stored, or transmitted?
- Data classification — Will the project handle Confidential or Restricted data (as defined in the Information Classification Framework)?
- Access changes — Will the project require new access rights, new user roles, new service accounts, or changes to existing access controls?
- Third-party involvement — Will the project involve new third-party services, APIs, or data sharing with external parties?
- Infrastructure changes — Will the project require new cloud resources, network configuration changes, or changes to existing infrastructure?
- Regulatory impact — Does the project affect compliance with GDPR, UAE PDPL, or other regulatory obligations?
- Customer impact — Could the project affect the security or privacy of customer data?
- Authentication and authorization — Does the project introduce or modify authentication or authorization mechanisms?
Security Classification of Projects
Based on the assessment answers, projects are classified:
| Classification | Criteria | Security Requirements |
|---|---|---|
| High Security Impact | Involves Restricted data, new external-facing services, significant infrastructure changes, new third-party data processing, or changes to authentication/authorization | Full security involvement: threat modelling, security design review, security testing, security sign-off required before go-live |
| Medium Security Impact | Involves Confidential data, internal service changes, new access roles, or minor infrastructure changes | Security review at design and pre-deployment stages; security testing required |
| Low Security Impact | No new data types, no infrastructure changes, no third-party involvement, internal process improvement only | Standard security controls apply; no additional security involvement required beyond adherence to existing policies |
Data Protection Impact Assessment (DPIA)
For projects classified as High Security Impact that involve processing personal data in new ways, a Data Protection Impact Assessment is conducted in accordance with the Data Protection Policy (CAR-ISMS-POL-008) and GDPR Article 35 requirements.
Security Gates in the Software Development Lifecycle
Gate 1: Design and Architecture Review
When: Before development begins on High and Medium Security Impact projects.
Activities:
- Review the proposed architecture for security considerations
- Identify data flows and data classification for all data handled by the project
- Evaluate authentication and authorization design
- Assess integration security (API security, third-party connection security)
- Identify applicable security controls from ISO 27001 Annex A
- Conduct threat modelling for High Security Impact projects (identify threats, attack vectors, and mitigations)
- Document security requirements that must be addressed during development
Output: Security design review record, documenting findings, decisions, and security requirements.
Participants: Project lead, engineering lead, Information Security Specialist.
Gate 2: Development and Code Security
When: During development (continuous).
Activities:
- Secure coding practices are followed per Carriyo's development standards
- Code reviews include security-focused review (input validation, authentication, authorization, error handling, data protection)
- Automated security scanning is integrated into the CI/CD pipeline (dependency scanning, static analysis)
- Secrets are managed through approved secrets management services (AWS Secrets Manager, GCP Secret Manager) and are never committed to source code
- Branch protection rules enforce peer review before merge
Output: Code review records, CI/CD scan results.
Participants: Development team, code reviewers.
Gate 3: Security Testing
When: Before deployment to production for High and Medium Security Impact projects.
Activities:
- Automated security testing (SAST, DAST) is executed and results are reviewed
- For High Security Impact projects: manual security testing or penetration testing is conducted
- Vulnerability findings are triaged and Critical/High findings must be resolved before deployment
- Medium findings are documented with a remediation plan and timeline
- Low findings are tracked for resolution in subsequent sprints
Output: Security test report, vulnerability triage record.
Participants: Engineering team, Information Security Specialist (for High Impact projects).
Gate 4: Pre-Deployment Security Review
When: Before production deployment for High Security Impact projects.
Activities:
- Verification that all security requirements identified in Gate 1 have been addressed
- Review of access control configurations for new resources
- Verification of encryption configurations (data at rest and in transit)
- Review of logging and monitoring configurations for new components
- Confirmation that infrastructure configurations align with baseline hardening standards
- Verification that documentation has been updated (architecture diagrams, runbooks, access registers)
Output: Pre-deployment security checklist (signed off).
Participants: Project lead, Information Security Specialist.
Gate 5: Post-Deployment Verification
When: Within 7 days of production deployment.
Activities:
- Verify that security controls are functioning as expected in the production environment
- Confirm that monitoring and alerting are operational for new components
- Verify that access controls are correctly configured and no excessive permissions remain
- Check for any security-related errors or anomalies in production logs
- Confirm operational documentation is complete and handed over
Output: Post-deployment verification record.
Participants: Engineering team, Information Security Specialist (for High Impact projects).
Third-Party and Vendor Projects
New Vendor Onboarding
Projects that involve onboarding a new third-party vendor or service provider must include:
- Vendor security assessment per the supplier security review process
- Data Processing Agreement (DPA) where personal data is involved
- Review of the vendor's security certifications and compliance posture
- Assessment of data flows between Carriyo and the vendor
- Definition of access requirements and least-privilege configuration
Customer Onboarding
Projects involving the onboarding of new enterprise customers must consider:
- Customer-specific data handling and residency requirements
- Data Processing Agreement execution
- Customer-required security controls or configurations
- Integration security (API key management, webhook security, data encryption)
Data Classification Requirements
All projects must identify and document the data they handle, including:
- Types of data processed, stored, or transmitted
- Data classification per Carriyo's Information Classification Framework (Restricted, Confidential, Internal, Public)
- Data flows (where data originates, where it is processed, where it is stored, who has access)
- Data retention requirements per the Data Retention and Disposal Policy (CAR-ISMS-POL-012)
- Data protection controls appropriate to the classification level
Responsibilities
| Role | Responsibilities |
|---|---|
| Project Lead | Conducts the initial security impact assessment; ensures security gates are completed; coordinates with the Information Security Specialist as required |
| Information Security Specialist | Participates in security design reviews and pre-deployment reviews for High Impact projects; advises on security requirements; maintains security gate templates and checklists; tracks security findings to closure |
| CTO / Head of Engineering | Ensures security in project management is embedded in development processes; arbitrates security vs. delivery trade-offs; approves risk acceptance for security findings that cannot be resolved before deployment |
| Engineering Team | Follows secure coding practices; addresses security findings from code reviews and automated scanning; implements security controls as specified |
| Management (CISO) | Ensures adequate resources for security involvement in projects; approves exceptions to security gate requirements for business-critical timelines |
Templates and Artefacts
The following templates support the implementation of this policy:
- Security Impact Assessment Form — Completed at project initiation
- Security Design Review Record — Documents findings from Gate 1
- Pre-Deployment Security Checklist — Completed before production deployment (Gate 4)
- Post-Deployment Verification Record — Completed after deployment (Gate 5)
- Security Exception Request — For cases where a security gate cannot be fully completed before deployment
Templates are maintained by the Information Security Specialist and are available in the ISMS document repository.
Exceptions
Where business urgency requires a project to proceed without completing all applicable security gates:
- The project lead submits a Security Exception Request documenting the gates that were not completed, the reason, and the proposed compensating controls
- The exception is approved by the CTO and the Information Security Specialist
- A remediation plan with specific dates is documented and tracked
- The exception is recorded in the ISMS non-conformity register if the risk is accepted beyond normal tolerance
Emergency deployments (e.g., critical security patches) may bypass standard gate processes but must complete a retrospective security review within 5 business days.
Review
This document is reviewed annually or when significant changes occur to Carriyo's project management practices, development lifecycle, or ISMS scope. Updates are processed through the standard document control procedure (CAR-ISMS-PRC-001).
Enforcement
Violations of this policy, including deployment of High or Medium Security Impact projects without completing required security gates, may result in disciplinary action. Repeated violations are escalated to management and addressed through the corrective action process.