The Learnable Secure SDLC #

Overview #

This site is the defined Secure Software Development Lifecycle for Learnable.

It describes how we build, review, and run our software: the controls we apply at each stage of delivery, the risks those controls address, and the evidence we expect to be able to produce for each one.

It applies to everyone who writes, reviews, deploys, or operates Learnable software.

This process is documented in version control, in an internal repository. The site you are reading is built from that repository’s main branch, so it is always the current process.

Why we define a process #

Defining a software delivery process is the first step towards compliance with any regulation or standard. Compliance requires us to define a process, implement it in our daily work, and be able to prove we followed it.

None of these standards require manual sign-offs, change advisory board meetings, or scheduled release windows. They require a defined process and evidence that it was followed — which is something automation does better than meetings.

You can read more about the reasoning behind this approach in Background.

What is in this process #

The process is organised into three areas, covering the whole path from source code to running production workload.

Secure Build — how software is produced and identified

• Artifact Binary Provenance
• Version Control
• Defined Toolchain
• Dependency Management

Secure Process — how changes are reviewed and approved

• Code Review
• Quality Assurance
• Security Vulnerability Scanning
• Deployment Approvals

Secure Runtime — how software is deployed and operated

• Change Records
• Deployment Controls
• Secrets Management
• Service Ownership
• Workload Monitoring

Alongside these, the process maintains a Risk Register mapping risks to the controls that mitigate them, an Exception Register recording documented deviations and their rationale, and our Training commitments.

Scope #

The scope of this framework is to secure the entire value stream of software development.

Changing this process #

The process is expected to change as Learnable does. Changes follow the same route as any other change we make:

1. Open a pull request against the internal repository that holds this site.
2. Have it reviewed by someone who understands the affected control and the risk it addresses.
3. Merge to main — the published site rebuilds automatically.

If a team needs to deviate from a control rather than change it for everyone, record it in the Exception Register.