This policy describes the requirements for software engineering capability across the Australian Government.
Applicability of this policy
Digital investment plans and proposals are assessed against this policy by the DTA through the Digital and ICT Investment Oversight Framework (IOF).
Policy requirements
Apply consistent software engineering practices
Agencies must follow a defined software engineering methodology when undertaking software development activities.
Agencies should consider adopting open standards in their software engineering approach.
Agencies should consider the role of Minimum Viable Product (MVP) and product-based approaches in their software engineering approach.
Build secure, composable and sustainable solutions
Agencies must align software engineering activities with Secure-by-Design and Zero Trust principles.
Agencies should ensure systems are composable and minimise technical debt.
Agencies should conduct architectural risk assessments and apply threat modelling at the master-planning and solution design phases to identify vulnerabilities.
Establish integrated governance and assurance
Agencies must ensure that the governance of software engineering activities is aligned with overarching organisational governance.
Agencies must ensure that AI-assisted software engineering activities, including AI-generated artefacts, are governed, independently verified, subject to human oversight, and reviewed and approved by suitably qualified personnel before operational use.