# Secure development planning — worksheet

Companion to EP01, *Secure Software Development in Practice*, Vitaliy Pikov.
This is an intentionally blank exercise. Adapt it to the actual product and obligations. A filled worksheet does not by itself establish conformity with GOST R 56939-2024.

## Product and record

- Product / version / components:
- Record owner / date / revision:
- Applicable context and standards to consider:
- Links to the repository and task tracker:

## Scope — 5.1.3.5

- Included software and why it was selected:
- Proposed exclusions, rationale and supporting evidence:
- Relationships that may require widening the scope:
- Who reviewed the boundary and when:

## Current state — 5.1.3.1

| Process | Implemented / not implemented / not assessed | Evidence | Sufficiency and conformity assessment | Gap |
|---|---|---|---|---|
| | | | | |

Inventory the relevant processes. Do not turn “not assessed” into “implemented” without examination. Link to actual records, not only statements that tools exist.

## Resources — 5.1.3.2

| Needed capability | People and availability | Tools / infrastructure | Estimate and assumptions | Unresolved constraint |
|---|---|---|---|---|
| | | | | |

## Improvement plan — 5.1.3.3

| Priority | Intended process change | Reason from the analyses | Resource dependency | Target sequence |
|---|---|---|---|---|
| | | | | |

Include relevant organizational changes, procurement and training needs. Explain prioritization.

## Implementation plan — 5.1.3.4

| Goal / action | Stage and date | Responsible person | Resources | Expected evidence | Status |
|---|---|---|---|---|---|
| | | | | | |

## Review and authority

- Review frequency selected by the organization:
- Additional review triggers:
- Who can resolve resource conflicts:
- Who can make the relevant release/risk decision under the applicable policy:
- Where changes and previous decisions are preserved:

## Discussion prompt

Ask another team member to find the next action, its owner and the expected result without a verbal explanation from you. Record what was unclear and improve the page.