What Is Policy

• A security standard you are holding your application to. Examples of well-known security standards that can be imported are: OWASP Top 10, SANS 25, PCI, HIPAA, etc.
• “Set of rules” that can be changed at any time. The rules can be based on:
• Business strategy
• Scan requirements (Static, Dynamic, SCA) 
• Application vulnerability scoring model 
• Reporting remediation compliance
• Remediation frequency 
• Mitigation process 
• Vulnerability management strategy

Policy Maturation

• Typically, programs will start out using Veracode’s prebuilt policies: Veracode Recommended Low/Veracode Recommended Medium
  • Performing baseline scans with these policies gives you a sense of the security posture of your application today without overwhelming developers with numerous findings.
  • Only High/Very High flaws will cause the application to fail the policy. These High/Very High flaws are a great place for your developers to begin fixing flaws.
• The next step is to build a custom policy with your Customer Success Manager
  • Create a custom policy based on existing internal security measures.
  • Have multiple policies based on speed in which testing can occur.