{"component": "clause", "props": {"groups": [{"samples": [{"hash": "b7vfzvvax5Z", "uri": "/contracts/b7vfzvvax5Z#secure-development", "label": "Software as a Service Agreement", "score": 36.0636940002, "published": true}, {"hash": "gonllP51FXF", "uri": "/contracts/gonllP51FXF#secure-development", "label": "Software as a Service Agreement", "score": 34.9578361511, "published": true}, {"hash": "k5AAbtvA0vt", "uri": "/contracts/k5AAbtvA0vt#secure-development", "label": "Software as a Service Agreement", "score": 34.1913757324, "published": true}], "snippet": "NetDocuments\u2019 Software Development Life Cycle (SDLC) methodology governs the acquisition, development, implementation, configuration, maintenance, modification, and management of software components. NetDocuments developers use secure coding guidelines based on leading industry standards and receive annual secure coding training. For each release, NetDocuments performs a security architecture review and conducts vulnerability scans and dynamic and static code reviews in the development environment. Identified vulnerabilities and coding defects are resolved prior to implementation, and an internal rollout is performed to test and troubleshoot the product release prior to placing it in production. NetDocuments utilizes a code versioning control system to maintain the integrity and security of application source code. Access privileges to the source code repository are reviewed quarterly and limited to authorized employees.", "snippet_links": [{"key": "software-development-life-cycle", "type": "clause", "offset": [14, 45]}, {"key": "the-acquisition", "type": "clause", "offset": [73, 88]}, {"key": "management-of", "type": "clause", "offset": [165, 178]}, {"key": "software-components", "type": "definition", "offset": [179, 198]}, {"key": "coding-guidelines", "type": "definition", "offset": [235, 252]}, {"key": "based-on", "type": "clause", "offset": [253, 261]}, {"key": "industry-standards", "type": "clause", "offset": [270, 288]}, {"key": "security-architecture", "type": "clause", "offset": [374, 395]}, {"key": "vulnerability-scans", "type": "clause", "offset": [416, 435]}, {"key": "development-environment", "type": "definition", "offset": [479, 502]}, {"key": "prior-to", "type": "clause", "offset": [563, 571]}, {"key": "an-internal", "type": "clause", "offset": [592, 603]}, {"key": "product-release", "type": "definition", "offset": [654, 669]}, {"key": "control-system", "type": "clause", "offset": [745, 759]}, {"key": "to-maintain", "type": "clause", "offset": [760, 771]}, {"key": "security-of", "type": "clause", "offset": [790, 801]}, {"key": "source-code", "type": "clause", "offset": [814, 825]}, {"key": "access-privileges", "type": "clause", "offset": [827, 844]}, {"key": "the-source", "type": "clause", "offset": [848, 858]}, {"key": "authorized-employees", "type": "definition", "offset": [913, 933]}], "size": 5, "hash": "6fc1eeb2a0004809bb5aa79614fcd9c8", "id": 1}, {"samples": [{"hash": "fTquMGHmu7W", "uri": "/contracts/fTquMGHmu7W#secure-development", "label": "Data Protection Agreement", "score": 31.224067688, "published": true}, {"hash": "aGE3jZ4BAEI", "uri": "/contracts/aGE3jZ4BAEI#secure-development", "label": "Data Protection Agreement", "score": 31.224067688, "published": true}], "snippet": "Supplier must implement and follow controls associated with the development, pre-production testing and delivery of any and all Services provided to Juniper Networks. For this section, Software or Hardware means the result of development, design, installation, configuration, production, or manufacture of computing code or devices that support or implement the Services. These secure development practices shall include the following:", "snippet_links": [{"key": "supplier-must", "type": "clause", "offset": [0, 13]}, {"key": "associated-with", "type": "definition", "offset": [44, 59]}, {"key": "the-development", "type": "clause", "offset": [60, 75]}, {"key": "production-testing", "type": "clause", "offset": [81, 99]}, {"key": "delivery-of", "type": "clause", "offset": [104, 115]}, {"key": "services-provided", "type": "definition", "offset": [128, 145]}, {"key": "juniper-networks", "type": "definition", "offset": [149, 165]}, {"key": "software-or-hardware", "type": "clause", "offset": [185, 205]}, {"key": "the-services", "type": "definition", "offset": [358, 370]}, {"key": "secure-development-practices", "type": "clause", "offset": [378, 406]}], "size": 4, "hash": "df4ef51d7452e8bd1a15c2b02868b85b", "id": 2}, {"samples": [{"hash": "6oCaqvnH64k", "uri": "/contracts/6oCaqvnH64k#secure-development", "label": "Software as a Service (Saas) Agreement", "score": 34.6635971069, "published": true}], "snippet": "Product management, development, test and deployment teams shall follow secure application development policies and procedures that are aligned to industry-standard practices, such as the OWASP Top 10.", "snippet_links": [{"key": "product-management", "type": "clause", "offset": [0, 18]}, {"key": "policies-and-procedures", "type": "clause", "offset": [103, 126]}, {"key": "standard-practices", "type": "definition", "offset": [156, 174]}], "size": 3, "hash": "41fe68a71c28c3d36644d4e9b5223950", "id": 3}, {"samples": [{"hash": "amyCRV2PgAV", "uri": "/contracts/amyCRV2PgAV#secure-development", "label": "Master Subscription Agreement", "score": 26.1334705353, "published": true}], "snippet": "Use secure development and coding standards including secure change management procedures in accordance with industry standards. Perform penetration testing and/or scanning prior to releasing new software versions. Licensor will provide internal standards and procedures to the University for review upon the University\u2019s request.", "snippet_links": [{"key": "coding-standards", "type": "clause", "offset": [27, 43]}, {"key": "change-management-procedures", "type": "clause", "offset": [61, 89]}, {"key": "in-accordance-with", "type": "clause", "offset": [90, 108]}, {"key": "industry-standards", "type": "clause", "offset": [109, 127]}, {"key": "penetration-testing", "type": "clause", "offset": [137, 156]}, {"key": "prior-to", "type": "clause", "offset": [173, 181]}, {"key": "new-software-versions", "type": "clause", "offset": [192, 213]}, {"key": "will-provide", "type": "clause", "offset": [224, 236]}, {"key": "standards-and-procedures", "type": "clause", "offset": [246, 270]}, {"key": "to-the-university", "type": "clause", "offset": [271, 288]}, {"key": "for-review", "type": "clause", "offset": [289, 299]}], "size": 1, "hash": "f01f1d2633cd14bf5cbafb58651819e4", "id": 4}, {"samples": [{"hash": "1HASJ8wxcab", "uri": "/contracts/1HASJ8wxcab#secure-development", "label": "Third Party Security Agreement", "score": 27.2847366333, "published": true}], "snippet": "The Third Party ensures that all software and services developed by the Third Party to provision the Third Party services, including those developed by the Third Party and those provided by others, have been developed following a secure software development lifecycle process which includes industry best practices for achieving and sustaining required security qualities for confidentiality, integrity and availability protection. In addition, software security vulnerabilities (see, for example the OWASP Top Ten or CWE listings) shall be avoided. The expected security measures and controls applied for software provisioning, such as Security Education of the development workforce, Secure Architecture and Design principles, Secure Coding practices, Security Testing methods and tools applied, Security Response to react timely on applicable software vulnerabilities that become known, as well as application security controls embedded and enforced by the software itself, such as identity management, authentication, authorization, encryption etc. shall be adequate to meet relevant business, technology and regulatory risks according to international standards such as ISO/IEC 27034. The Third Party has procedures in place to ensure integrity of software updates and can demonstrate that precautions are taken to ensure that any own or Third Party or open source software used for providing the Third Party services do not contain known backdoors, viruses, trojans or other kind of malicious code.", "snippet_links": [{"key": "the-third-party", "type": "definition", "offset": [0, 15]}, {"key": "software-and-services", "type": "clause", "offset": [33, 54]}, {"key": "third-party-services", "type": "clause", "offset": [101, 121]}, {"key": "software-development-lifecycle", "type": "clause", "offset": [237, 267]}, {"key": "industry-best-practices", "type": "clause", "offset": [291, 314]}, {"key": "required-security", "type": "definition", "offset": [344, 361]}, {"key": "in-addition", "type": "clause", "offset": [432, 443]}, {"key": "security-vulnerabilities", "type": "definition", "offset": [454, 478]}, {"key": "for-example", "type": "definition", "offset": [485, 496]}, {"key": "security-measures", "type": "definition", "offset": [563, 580]}, {"key": "for-software", "type": "clause", "offset": [602, 614]}, {"key": "security-education", "type": "clause", "offset": [637, 655]}, {"key": "the-development", "type": "clause", "offset": [659, 674]}, {"key": "design-principles", "type": "definition", "offset": [710, 727]}, {"key": "secure-coding-practices", "type": "definition", "offset": [729, 752]}, {"key": "testing-methods", "type": "clause", "offset": [763, 778]}, {"key": "and-tools", "type": "clause", "offset": [779, 788]}, {"key": "security-response", "type": "clause", "offset": [798, 815]}, {"key": "applicable-software", "type": "definition", "offset": [835, 854]}, {"key": "security-controls", "type": "definition", "offset": [913, 930]}, {"key": "the-software", "type": "definition", "offset": [956, 968]}, {"key": "identity-management", "type": "definition", "offset": [985, 1004]}, {"key": "relevant-business", "type": "definition", "offset": [1079, 1096]}, {"key": "regulatory-risks", "type": "clause", "offset": [1113, 1129]}, {"key": "according-to", "type": "definition", "offset": [1130, 1142]}, {"key": "international-standards", "type": "definition", "offset": [1143, 1166]}, {"key": "in-place", "type": "definition", "offset": [1221, 1229]}, {"key": "to-ensure", "type": "clause", "offset": [1230, 1239]}, {"key": "integrity-of", "type": "clause", "offset": [1240, 1252]}, {"key": "software-updates", "type": "definition", "offset": [1253, 1269]}, {"key": "open-source-software", "type": "definition", "offset": [1358, 1378]}, {"key": "providing-the", "type": "clause", "offset": [1388, 1401]}, {"key": "malicious-code", "type": "clause", "offset": [1489, 1503]}], "size": 1, "hash": "906bcbcf87f8ebbf096a8a4bb21fa9d2", "id": 5}, {"samples": [{"hash": "1yIaaxOriia", "uri": "/contracts/1yIaaxOriia#secure-development", "label": "Data Processing Agreement", "score": 27.6283359528, "published": true}], "snippet": "Code complexity increases the chance of security issues. CDD Solutions makes use of internal code reviews, linting tools, code security tools and automated tests to ensure the quality of the code, so it can be extended and maintained effectively. CDD Solutions strives to keep software dependencies up to date to mitigate the risk of security vulnerabilities. Development environments are password protected and encrypted using full disk encryption. CDD Solutions\u2019 code repositories are protected using two-factor authentication. Passwords are stored securely in a password manager.", "snippet_links": [{"key": "security-issues", "type": "definition", "offset": [40, 55]}, {"key": "internal-code", "type": "definition", "offset": [84, 97]}, {"key": "security-tools", "type": "definition", "offset": [127, 141]}, {"key": "to-ensure", "type": "clause", "offset": [162, 171]}, {"key": "the-code", "type": "clause", "offset": [187, 195]}, {"key": "software-dependencies", "type": "definition", "offset": [277, 298]}, {"key": "up-to-date", "type": "definition", "offset": [299, 309]}, {"key": "to-mitigate", "type": "definition", "offset": [310, 321]}, {"key": "the-risk", "type": "clause", "offset": [322, 330]}, {"key": "security-vulnerabilities", "type": "definition", "offset": [334, 358]}, {"key": "development-environments", "type": "definition", "offset": [360, 384]}, {"key": "password-manager", "type": "clause", "offset": [565, 581]}], "size": 1, "hash": "630b6e22dc85f49028718eeeaa3d1f33", "id": 6}, {"samples": [{"hash": "hWVdJd4t4gx", "uri": "/contracts/hWVdJd4t4gx#secure-development", "label": "Data Processing Addendum", "score": 34.3774032593, "published": true}], "snippet": "CI/CD with automated dependency scanning; code reviews.", "snippet_links": [], "size": 1, "hash": "5fb8c70b13dcfde5e23b9f79b75f571d", "id": 7}, {"samples": [{"hash": "iG5pRGqtDV1", "uri": "/contracts/iG5pRGqtDV1#secure-development", "label": "Platform Services, Transfer Agent, and Registrar Agreement (Blackrock Funds)", "score": 37.6543463381, "published": true}], "snippet": "Securitize shall ensure that:\ni. All development activities (internal and outsourced) are performed in accordance with a documented Secure Software Development Lifecycle (\u201cSDLC\u201d) Methodology, which shall be shared with the Fund upon request.\nii. Securitize Personnel involved in any part of the SDLC process undergo Industry Standard application security training.\niii. Developers\u2019 access to production is limited to emergency and/or support purposes and subject to the logging and monitoring requirements of this Appendix.\niv. System development and testing are performed in distinct environments segregated from the production environment and protected against unauthorized disclosure of Confidential Information.\nv. Confidential Information is never used within test environments without prior approval from the Fund. Software Bill of Materials (SBOM). Upon reasonable request, Securitize shall provide information reasonably sufficient to identify the material software, infrastructure dependencies, hosting providers, and third-party technology providers supporting the Services, within 30 days. Such requirement may be satisfied through a software bill of materials, technology inventory, vendor inventory, or substantially similar documentation.", "snippet_links": [{"key": "development-activities", "type": "definition", "offset": [37, 59]}, {"key": "in-accordance-with", "type": "clause", "offset": [100, 118]}, {"key": "software-development-lifecycle", "type": "clause", "offset": [139, 169]}, {"key": "the-fund", "type": "clause", "offset": [219, 227]}, {"key": "upon-request", "type": "clause", "offset": [228, 240]}, {"key": "personnel-involved", "type": "clause", "offset": [257, 275]}, {"key": "security-training", "type": "clause", "offset": [346, 363]}, {"key": "access-to-production", "type": "clause", "offset": [382, 402]}, {"key": "subject-to-the", "type": "clause", "offset": [455, 469]}, {"key": "monitoring-requirements", "type": "definition", "offset": [482, 505]}, {"key": "development-and-testing", "type": "clause", "offset": [535, 558]}, {"key": "production-environment", "type": "clause", "offset": [618, 640]}, {"key": "unauthorized-disclosure-of-confidential-information", "type": "clause", "offset": [663, 714]}, {"key": "test-environments", "type": "clause", "offset": [765, 782]}, {"key": "prior-approval", "type": "definition", "offset": [791, 805]}, {"key": "bill-of-materials", "type": "definition", "offset": [830, 847]}, {"key": "reasonable-request", "type": "definition", "offset": [861, 879]}, {"key": "provide-information", "type": "clause", "offset": [898, 917]}, {"key": "material-software", "type": "definition", "offset": [956, 973]}, {"key": "hosting-providers", "type": "clause", "offset": [1004, 1021]}, {"key": "technology-providers", "type": "clause", "offset": [1039, 1059]}, {"key": "the-services", "type": "definition", "offset": [1071, 1083]}, {"key": "substantially-similar", "type": "definition", "offset": [1216, 1237]}], "size": 1, "hash": "d356e3b72c4b0de7ffacdec743709c2b", "id": 8}, {"samples": [{"hash": "9HMDQllCiTL", "uri": "/contracts/9HMDQllCiTL#secure-development", "label": "Corporate Contract", "score": 25.1423683167, "published": true}], "snippet": "a) The system shall be engineered following the \u2018security by design\u2019 principles.\nb) The system shall be developed following the \u2018data protection by design and by default\u2019 principle. Hence appropriate technical and organizational measures shall be in place to implement the data protection principles and safeguard individual rights. Data protection shall be integrated in processing activities and operational practices, from the design stage throughout the solutions lifecycle.\nc) Development and tests of the system will be done with fictitious or pseudonymized information.\nd) Any source code developed specifically for the system shall undergo a security assurance testing, and business impact analysis to bring operational business to acceptable level. Risk tolerance level shall the established by the system / solution owner.\ne) Access to program source code and associated items - such as designs, specifications, testing and validation plans - shall be strictly controlled; to prevent the introduction of unauthorized functionality.\nf) The system shall display generic error messages that do not disclose detailed information such as process logs, account or system information.\ng) Executable code will not be implemented on an operational system until evidence of conforming to the testing criteria (user approval, QA, or the equivalent) is acquired and the associated program source libraries have been updated.", "snippet_links": [{"key": "the-system", "type": "definition", "offset": [3, 13]}, {"key": "following-the", "type": "definition", "offset": [34, 47]}, {"key": "security-by-design", "type": "clause", "offset": [49, 67]}, {"key": "data-protection-by-design", "type": "definition", "offset": [129, 154]}, {"key": "by-default", "type": "clause", "offset": [159, 169]}, {"key": "appropriate-technical-and-organizational-measures", "type": "clause", "offset": [188, 237]}, {"key": "in-place", "type": "definition", "offset": [247, 255]}, {"key": "the-data-protection-principles", "type": "clause", "offset": [269, 299]}, {"key": "individual-rights", "type": "definition", "offset": [314, 331]}, {"key": "processing-activities", "type": "clause", "offset": [372, 393]}, {"key": "operational-practices", "type": "clause", "offset": [398, 419]}, {"key": "design-stage", "type": "definition", "offset": [430, 442]}, {"key": "source-code", "type": "clause", "offset": [584, 595]}, {"key": "security-assurance", "type": "definition", "offset": [650, 668]}, {"key": "business-impact-analysis", "type": "clause", "offset": [682, 706]}, {"key": "operational-business", "type": "clause", "offset": [716, 736]}, {"key": "acceptable-level", "type": "definition", "offset": [740, 756]}, {"key": "tolerance-level", "type": "definition", "offset": [763, 778]}, {"key": "access-to-program", "type": "clause", "offset": [836, 853]}, {"key": "testing-and-validation", "type": "clause", "offset": [922, 944]}, {"key": "error-messages", "type": "clause", "offset": [1078, 1092]}, {"key": "detailed-information", "type": "clause", "offset": [1114, 1134]}, {"key": "system-information", "type": "definition", "offset": [1168, 1186]}, {"key": "executable-code", "type": "clause", "offset": [1191, 1206]}, {"key": "evidence-of", "type": "definition", "offset": [1262, 1273]}, {"key": "testing-criteria", "type": "definition", "offset": [1292, 1308]}, {"key": "associated-program", "type": "definition", "offset": [1368, 1386]}], "size": 1, "hash": "895c5518171a309cbd9f54d571b6dccb", "id": 9}, {"samples": [{"hash": "jadWR8kb7L0", "uri": "/contracts/jadWR8kb7L0#secure-development", "label": "Independent Contractor Agreement", "score": 27.3270721436, "published": true}], "snippet": "Use secure development and coding standards including secure change management procedures in accordance with industry standards. Perform penetration testing and/or scanning prior to releasing new software versions. Vendor will provide internal standards and procedures to ASU for review upon ASU request.\nA. Minimum Scope and Limits of Liability: Vendor will provide coverage with limits of liability not less than those stated below:", "snippet_links": [{"key": "coding-standards", "type": "clause", "offset": [27, 43]}, {"key": "change-management-procedures", "type": "clause", "offset": [61, 89]}, {"key": "in-accordance-with", "type": "clause", "offset": [90, 108]}, {"key": "industry-standards", "type": "clause", "offset": [109, 127]}, {"key": "penetration-testing", "type": "clause", "offset": [137, 156]}, {"key": "prior-to", "type": "clause", "offset": [173, 181]}, {"key": "new-software-versions", "type": "clause", "offset": [192, 213]}, {"key": "vendor-will-provide", "type": "clause", "offset": [215, 234]}, {"key": "standards-and-procedures", "type": "clause", "offset": [244, 268]}, {"key": "for-review", "type": "clause", "offset": [276, 286]}, {"key": "limits-of-liability", "type": "clause", "offset": [326, 345]}], "size": 1, "hash": "f88df14977a74111cd2037f10ff61602", "id": 10}], "next_curs": "ClsSVWoVc35sYXdpbnNpZGVyY29udHJhY3RzcjcLEhZDbGF1c2VTbmlwcGV0R3JvdXBfdjU2IhtzZWN1cmUtZGV2ZWxvcG1lbnQjMDAwMDAwMGEMogECZW4YACAA", "clause": {"children": [["graylogs-software-development", "Graylog\u2019s Software Development"], ["development-requirements", "Development requirements"], ["open-source-and-third-party-software", "Open source and third party software"], ["graylogs-software-development-life-cycle", "Graylog\u2019s Software Development Life Cycle"], ["", ""]], "title": "Secure Development", "parents": [["solution-security", "Solution Security"], ["relationship-with-the-agreement", "RELATIONSHIP WITH THE AGREEMENT"], ["general", "General"], ["counterparts", "Counterparts"], ["miscellaneous", "Miscellaneous"]], "size": 28, "id": "secure-development", "related": [["project-development", "Project Development", "Project Development"], ["future-developments", "Future Developments", "Future Developments"], ["software-development", "Software Development", "Software Development"], ["joint-development", "Joint Development", "Joint Development"], ["staff-development", "Staff Development", "Staff Development"]], "related_snippets": [], "updated": "2026-09-04T05:52:11+00:00", "also_ask": ["What minimum security standards should be mandated in a Secure Development clause?", "How can the clause allocate liability for security breaches during development?", "What negotiation leverage exists regarding third-party code and open-source components?", "How do courts assess enforceability of Secure Development obligations in disputes?", "How does this clause compare to industry best practices and regulatory requirements?"], "drafting_tip": "Specify security standards, require regular code reviews, and mandate vulnerability testing to ensure robust protection and reduce risk of breaches.", "explanation": "The Secure Development clause establishes requirements for incorporating security best practices throughout the software development lifecycle. It typically mandates that developers follow secure coding standards, conduct regular code reviews, and implement vulnerability assessments or testing before deployment. By embedding security into each stage of development, this clause helps prevent security flaws and reduces the risk of breaches, ensuring that the final product is robust against cyber threats."}, "json": true, "cursor": ""}}