How to document System Secure Engineering Principles

We've received the following question: I want to know how to document System Secure Engineering Principles? What is the Content for that? Answer: System Secure Engineering Principles refers to the set of security techniques in all architectural layers – business, data, applications and technology you are using in your organization. Those principles shall be documented in a policy and regularly reviewed. As an example you should look on the Software Development LifeCycle phases and define the set of security techniques in each phase: - Project initiation and planning; - Functional requirements definition; - Systems design specifications; - Build (develop) and document - Acceptance - Transition to production (instalation) These set of considerations shall also be applied to outsourcers where applicable, using contracts and other binding agreements between parties. Hope it helps