sg-gov-secure-coding-as

Secure coding for SG Government: AS + CK controls

The ICT&SS Policy Reform (IM8's successor) Cybersecurity Control Catalog contains 15 Application Security (AS) controls and 4 Cryptography/Key Management (CK) controls that land directly in application code. This skill maps them to coding decisions so an agent writing or reviewing code produces compliant output the first time, with control IDs the agency's security team can trace to its System Security Plan (SSP).

Use this skill in three modes:

1. Writing new code: apply the scenario sections below as you write.
2. Reviewing a diff: run the review checklist against every changed file; flag violations with the control ID.
3. Auditing a codebase: sweep for each checklist row; report findings per control ID with file:line references.

Source and currency

Control text in this skill and in references/as-controls.md is embedded from info.standards.tech.gov.sg as of 2026-07-16. The standards iterate actively. For compliance-critical decisions (SSP evidence, audit responses, deviations), verify against the live pages:

• AS family: https://info.standards.tech.gov.sg/control-catalog/cybersecurity/as/
• CK family: https://info.standards.tech.gov.sg/control-catalog/cybersecurity/ck/
• SSP profiles (control levels): https://info.standards.tech.gov.sg/ssp/

Machine-readable OSCAL: https://github.com/GovtechSG/tech-standards is useful for tooling but lags the site; the site is authoritative.

Before you start: levels and parameters

• Levels come from the project's SSP, not the catalog. Level 0 = mandatory, no deviation. Level 1 = default; deviations need documented IDSC/CIO/CISO approval. Level 2 = risk-based best practice. In the Medium-Risk Cloud SSP, AS-1, AS-3, AS-7 and AS-8 are Level 0 (promoted from Level 1 in low-risk); AS-10, AS-12, AS-13, AS-14 sit at Level 2 in both cloud SSPs; CK-1/CK-2 are Level 1 in medium-risk. Use the sibling skill sg-gov-ssp-navigator to determine the applicable SSP and each control's level for this system. Treat every control below as required unless the SSP says otherwise.
• Parameters are agency-defined. as-5_prm_1/2/3 (password length, policy, type), as-11_prm_1/2 (session hours, session type), ck-2_prm_1 (key rotation days) have no catalog values. Never invent them. Ask the user for the project's SSP parameter values, or locate them in the repo (SSP document, security config, compliance docs). If unavailable, implement against a named configuration constant, flag it as TODO(SSP): confirm as-5_prm_1, and say so in your report.