Building trust and resilience through secure software practices

Key insights

• Sage used the British government’s information Code of Practice for Software Security to assess and strengthen security, governance and assurance across the Copilot Factory Framework.
• This is what the assessment revealed Embedding security throughout software design, development, deployment and maintenance helps create more resilient AI-powered services.
• sage improved its governance by formalizing access reviews, third-party dependency controls, vulnerability management processes, and security documentation.
• Cross-functional collaboration between Security, Product, Engineering, Architecture and CloudOps helped Sage assess software security across the entire development lifecycle.
• Organizations can use the Software Security Code of Practice as a practical framework for continuous improvementstronger customer security and greater cyber resilience.

Digital services are central to the way companies manage their finances, people and operations. As reliance on software increases, users need to be confident that the technology they rely on is designed, developed and maintained with security in mind.

At Sage, strengthening software security is part of our broader commitment to building trust and resilience.

As a signatory of the British government Cyber ​​Resilience Pledge and ambassador of the Code of Practice for Software SecurityWe are committed to finding practical ways to test our approach to security, learn from the process, and help promote stronger security across the software ecosystem. At the same time, we encourage our partners to do the same.

This is what we talk about in this article:

Why Sage supports the Cyber ​​Resilience Pledge

Cyber ​​resilience is not just a technical priority.

This is critical for business continuity, customer trust and responsible innovation. By supporting the Pledge and Code, Sage reiterates its commitment to secure software practices and government-industry collaboration.

Our participation in the Code of Conduct reflects our broader responsibilities and sharing practical experiences can help organizations understand the Code, identify opportunities to strengthen their own approach and treat security as an ongoing business priority rather than a one-off compliance activity.

The approach

Sage has selected the Copilot Factory Framework (CFF) for evaluation against the Software Security Code of Practice.

The CFF provides a scalable foundation for delivering AI-powered experiences across Sage products, enabling teams to build and deploy AI capabilities using consistent governance, security controls and approved technologies.

His role on multiple product teams made the CFF a valuable example for evaluating how to apply safe and responsible development practices within a modern AI platform.

Colleagues from security, product, engineering, architecture and CloudOps took part in the assessment.

A dedicated security lead coordinated the collection and validation of evidence, and an independent third party (NCC Group) verified the evidence against the Code’s controls.

This approach helped provide a clear overview of existing strengths and areas where governance, documentation and security could be further developed.

Key results and lessons learned

Embedding security into design and development: The review highlighted the value of integrating security into development practices.

Software development teams use tools called source control to track the code they create.

For the CFF, embedding security into design and development included source control through a tool called GitHub, as well as access management using single sign-on and multi-factor authentication, as well as automated testing before code can be merged.

This led to:

• Stronger governance for third-party services and dependencies.
• Clearer documentation and evidence related to component management and licensing.

Strengthen security around the build environment: The tools that software development teams use are called the build environment. The assessment reviewed controls that support the build environment, including managed access, strong authentication, infrastructure-as-code practices, and audit logging.

It also highlighted the value of formal, repeatable access reviews to continually ensure that permissions continue to be appropriate.

As a result there was:

• More formal GitHub repository and team access review processes.
• Improved evidence for development environment security controls and infrastructure management.

Validate secure deployment and maintenance: The review examined how vulnerabilities are identified, prioritized, and managed.

Existing practices included automated scanning, penetration testing, bug bounty investigations, centralized risk management in ArmorCode, Common Vulnerability Scoring System (CVSS)-based prioritization, and management based on internal service level agreements.

This led to practices that:

• Validate vulnerability management practices against the Code.
• Clearer documentation to support security maintenance and service governance.
• Stronger evidence on how vulnerabilities are prioritized and remedied.

Make service commitments clearer: CFF primarily provides AI services for other Sage products. Some requirements of the Code had to be considered in the context of internal product customers.

The assessment provided an opportunity to clarify the supported service lifecycle and communication commitments, resulting in:

• Formalized support and service lifecycle policies.
• A commitment to discontinue supported services up to 12 months in advance.
• Improved documentation of support and communication processes.

Advice and insights for other organizations

Our experience tips to take away can be summarized as follows:

• Use the Code as a catalyst for improvement. The greatest benefit can come from the conversations the assessment generates and the opportunities it uncovers. Small changes to governance or documentation can provide greater clarity, accountability and security.
• Articulate what already works. While best practices already exist, clear accountability, documented commitments and accessible evidence make it easier to demonstrate that controls are working as intended.
• Bring the right people together early. Software security encompasses more than one function. Integrating security, product, engineering, architecture, and operations provides a more complete view of how security is applied across the entire lifecycle.
• Focus on learning, not just compliance. The Code is most useful when it supports honest reflection and continuous improvement. The goal is not just to complete an assessment, but to use it to strengthen resilience and customer security.

Final Thoughts: Future Commitments

The Software Security Code of Practice provides companies with a valuable opportunity to strengthen security, build customer trust, and demonstrate responsible leadership. It’s a significant improvement – not just compliance – that means organizations can improve resilience and help raise security standards across the industry.

For organizations considering the Code, the first step is to assess how its principles align with existing practices, identify where ownership or evidence could be strengthened, and involve the right teams early.

Sage continues to advocate for the Code beyond our own assessment, with our partners also participating and contributing to stronger security across the software ecosystem. You can view one of the partner case studies here: https://zynk.com/articles/why-zynk-adopted-the-dcms-software-security-code-of-practice.

Browse other topics from this article