This sample report records the result of an evaluation of application development and change control security policies and procedures at an organization. The purpose of this report is to illustrate a format that can be used to communicate the status of company policies, and also to present recommendations for policy changes to management, including details of specific policy and procedure findings, gaps and recommendations regarding policy changes.

This report also illustrates application development and change control security policy issues and best practices that could be incorporated into your own review.