> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/security-measures/security-in-acquisition-development-and-maintenance-of-network-and-information-systems.md).

# Security in acquisition, development, and maintenance of network and information systems

Glesys establishes security requirements and controls for systems throughout their lifecycle, including development and operational maintenance.

### Key elements:

* **System lifecycle control:** Systems are acquired, classified, assigned owners, documented, reviewed, and decommissioned in a controlled manner.
* **Secure development practices:** Separation of environments, secure coding standards, version control, security testing (e.g., static analysis), and controls for outsourced development.
* **Controlled changes:** Changes are recorded, risk-assessed, approved, validated, and reviewed to reduce security and stability risks.