> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/annex-information-security/7.-security-in-acquisition-development-and-maintenance-of-network-and-information-systems.md).

# 7. Security in Acquisition, Development and Maintenance of Network and Information Systems

7.1 Glesys establishes security requirements and controls for systems throughout their lifecycle, including development and operational maintenance, including but not limited to:

a) system lifecycle controls, ensuring that systems are acquired, classified, assigned owners, documented, reviewed and decommissioned in a controlled manner;

b) secure development practices, including separation of development, testing and production environments, adherence to secure coding standards, use of version control, guidelines and procedures for security testing (e.g. static analysis) and appropriate controls for outsourced development; and

c) controlled change management, whereby changes are recorded, risk-assessed, approved, validated, and reviewed to reduce security and stability risks.

7.2 Glesys has established and maintains documented procedures for the identification, assessment, management and disclosure of vulnerabilities affecting its network and information systems. Glesys shall remediate identified vulnerabilities without undue delay and as soon as reasonably practicable, taking into account the severity of the vulnerability and the associated risk.

7.3 Glesys shall inform the Customer, within a reasonable time, of any identified vulnerability that Glesys reasonably considers may affect the Customer.