Software Development Version Control Standards

1.1 Scope of Application

These standards apply to:

• All internal government development teams and personnel
• External contractors and third-party vendors
• Automated systems involved in source code management
• All government software projects, including proof-of-concepts and pilot programs
• Legacy systems undergoing modernization

1.2 Compliance Requirements

• Mandatory compliance for all new projects starting after the effective date
• Phased compliance for existing projects within 12 months
• Risk-based exceptions may be granted by the Ministry of Information & Digitalisation with documented justification

2. Core Objectives

• Security First: Ensure security and integrity of source code repositories through defense-in-depth approaches
• Collaboration: Facilitate secure collaboration while maintaining code quality and consistency
• Accountability: Provide complete traceability and accountability for all code changes
• Compliance: Align with international cybersecurity standards and Malawi's legal frameworks
• Efficiency: Enable efficient development workflows without compromising security
• Resilience: Ensure business continuity through robust backup and disaster recovery capabilities

3. Version Control System (VCS) Standards

3.1 Approved Platforms

• Primary Platform: GitLab Enterprise (self-hosted on government infrastructure)
• Alternative: GitHub Enterprise Server (for specific use cases requiring approval)
• Prohibited: Public repositories, personal accounts, or unauthorized cloud-based services

3.2 Infrastructure Requirements

• Government-controlled infrastructure with appropriate security controls
• High availability configuration with minimum 99.5% uptime SLA
• Geographic redundancy with backup sites in different regions
• Network segregation from public internet where feasible
• Regular security patching and vulnerability management

3.3 Repository Management

• Centralized administration with defined ownership hierarchies
• Standardized naming conventions: ministry-department-project-component
• Repository templates for consistent project initialization
• Automated repository lifecycle management including archival procedures

4. Access Control & Authentication

4.1 Authentication Requirements

• Multi-Factor Authentication (MFA) mandatory for all users
• Single Sign-On (SSO) integration with government identity providers
• Strong password policies aligned with NIST SP 800-63B guidelines
• Regular credential rotation every 90 days for service accounts

4.2 Authorization Framework

• Role-Based Access Control (RBAC) implemented at repository, branch, and feature levels
• Principle of Least Privilege strictly enforced
• Just-in-time access for elevated permissions
• Automated access reviews quarterly with manager approval

4.3 Access Roles and Permissions

• Repository Owner: Full administrative access (ministry/department heads)
• Maintainer: Merge permissions, user management (project leads)
• Developer: Push to feature branches, create pull requests
• Reviewer: Code review permissions, merge approvals
• Auditor: Read-only access for compliance and security reviews
• Guest: Limited read access for specific branches/files

5. Branching & Workflow Models

5.1 Branching Strategy Selection

• Git Flow: For large, complex projects with scheduled releases
• GitHub Flow: For continuous deployment scenarios
• Trunk-Based Development: For small teams with high collaboration needs
• Feature Branching: Default for most government projects

5.2 Branch Protection Rules

• Protected branches: main, develop, release/*, hotfix/*
• Required status checks: All CI tests must pass
• Mandatory reviews: Minimum 2 approvals for critical branches
• No direct commits to protected branches
• Dismiss stale reviews when new commits are pushed

5.3 Naming Conventions

• feature/[ticket-number]-[short-description]
• bugfix/[ticket-number]-[short-description]
• hotfix/[ticket-number]-[short-description]
• release/[version-number]
• chore/[short-description]

6. Code Review & Quality Assurance

6.1 Mandatory Review Process

• Peer reviews required for all code changes
• Security reviews required for high-risk changes
• Architecture reviews for significant design changes
• Review checklists to ensure consistency

6.2 Automated Quality Gates

• Static Application Security Testing (SAST) integrated into CI/CD
• Dynamic Application Security Testing (DAST) for web applications
• Dependency vulnerability scanning using tools like Snyk or OWASP Dependency-Check
• Code quality metrics using SonarQube or similar tools
• License compliance checking for third-party dependencies

6.3 Quality Standards

• Minimum 80% code coverage for unit tests
• Zero critical or high-severity security vulnerabilities
• Compliance with government coding standards (to be published separately)
• Documentation requirements for all public APIs and complex business logic

7. Cybersecurity Standards & Practices

7.1 Secure Development Lifecycle

• OWASP Secure SDLC implementation across all projects
• NIST SP 800-190 compliance for containerized applications
• Threat modeling required for all new projects
• Security champions program within development teams

7.2 Secure Coding Requirements

• Input validation and sanitization for all user inputs
• Output encoding to prevent injection attacks
• Proper error handling without information disclosure
• Secure authentication and session management
• Regular security training for all developers

7.3 Secrets Management

• No hardcoded credentials in source code
• Dedicated secrets management solutions (HashiCorp Vault on government infrastructure)
• Environment-specific configuration management
• Regular secrets rotation and monitoring

8. Audit Logging & Compliance

8.1 Comprehensive Logging

• All repository activities: commits, merges, access attempts, permission changes
• User authentication events: logins, failures, privilege escalations
• System administrative activities: configuration changes, user management
• Integration events: CI/CD pipeline executions, deployment activities

8.2 Log Management

• Centralized logging with tamper-proof storage
• Log retention: Minimum 7 years for audit trails
• Real-time monitoring for suspicious activities
• Regular log analysis and threat detection

8.3 Compliance Framework

• Malawi Data Protection Act (2021) compliance
• ISO/IEC 27001 alignment for information security
• Regular compliance audits by internal and external auditors
• Incident response procedures for security breaches

9. Integration with CI/CD Pipelines

9.1 Pipeline Requirements

• Automated build and test execution on all code changes
• Security gates at multiple pipeline stages
• Deployment approvals for production environments
• Rollback capabilities for failed deployments

9.2 Security Integration

• Container image scanning for vulnerabilities
• Infrastructure as Code (IaC) security scanning
• Runtime security monitoring for deployed applications
• Compliance validation before production deployment

9.3 Traceability Requirements

• Complete audit trail from code commit to production deployment
• Change impact analysis for regulatory compliance
• Automated documentation generation for deployments

10. Data Protection & Confidentiality

10.1 Data Classification

• Public: Open source components, documentation
• Internal: Government-specific implementations
• Confidential: Sensitive algorithms, security configurations
• Restricted: Classified systems, national security applications

10.2 Protection Measures

• Encryption at rest and in transit for all repositories
• Data loss prevention (DLP) tools to prevent unauthorized data exposure
• Regular data classification reviews and updates
• Secure deletion procedures for archived repositories

10.3 Privacy Compliance

• Personal data minimization in code and logs
• Privacy impact assessments for data processing activities
• Data subject rights implementation for citizen-facing applications

12. Training & Awareness

12.1 Training Requirements

• Security awareness training for all developers (annual)
• Secure coding training for development teams (semi-annual)
• Tool-specific training for platform administrators
• Incident response training for security teams

12.2 Certification Requirements

• Security certifications encouraged for senior developers
• Platform certifications required for administrators
• Continuing education requirements for all technical staff

13. Governance & Enforcement

13.1 Governance Structure

• Ministry of Information & Digitalisation: Overall governance and policy
• Digital Security Committee: Technical oversight and standards development
• Departmental Security Officers: Local implementation and compliance
• Project Security Champions: Day-to-day security advocacy

13.2 Enforcement Mechanisms

• Automated compliance monitoring with dashboard reporting
• Regular security assessments of repositories and practices
• Non-compliance escalation procedures with defined timelines
• Disciplinary actions for repeated violations

13.3 Continuous Improvement

• Annual standards review by governance committee
• Quarterly security metrics reporting
• Lessons learned integration from security incidents
• Industry best practices adoption and evaluation