Policy Register
Every policy type · Operations and technology

API security standard

The authentication, authorisation, rate limiting, input validation and logging rules every interface the organisation exposes must meet.

How the register reads it

Also calledAPI standard, interface security
FamilyOperations and technology
Document typeStandard. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the secure development policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerThe head of engineering or the CTO.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, secure development policy, is).
TemplateApi security policy.

Which standards require it, and what each expects it to contain

1 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.26 Application security requirements

Identify, specify and approve security requirements when developing or acquiring applications.

What the ISO 27002 guidance expects the document to say: Requires information security requirements to be identified, specified and approved when applications are being developed or acquired.

Evidence an auditor accepts: The method for identifying security requirements for applications, whether developed or acquired; documented and approved security requirements for applications delivered in the period, covering authentication, authorisation, data protection, logging and error handling; evidence requirements were derived from risk, from the data classification and from applicable legal obligations
Common gap: Security requirements not formally approved
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Software asset management policy · Backup policy