SDLC Framework WG Bi-weekly call - April 27th 2026

[aaronsearle]

Date

Monday January 5th- 1000 EST / 1500UK

Untracked attendees

Name	Firm	Comment

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene, roll call, welcome new people
• Bulk import risks - Alex
• Toronto Finos
• New Control - Testing Evidence/Evidence Of Testing - Aaron
• Service Dependency - George/Anupriya
• Next Steps
• AOB, Q&A & Adjourn (5mins)

Action Items

• Review Testing Evidence, policy
• Send out mails about cancelled meeting for the bank holiday
• Site Update: Include state on each panel
• Site Update: New state for rejected/out of scope and second reading
• New Controls: Toolchain Inventory
• Minor update: Service dependency to not include package info
• Minor update: Testing Policy should include upstream/downstream with reference to service dependency control add as related.
• Minor update: Infrastructure as code may not have a content addressable deployment.

Meeting Notes

Zoom info

(https://zoom-lfx.platform.linuxfoundation.org/meeting/96292319760?password=a023f03e-c2aa-46fb-aae3-5d93c9d9664e)

Github Repo: https://github.com/finos-labs/SDLC-Controls-Framework/

Project Board: SDLC Project Board

Mailing List: Email sdlc-framework+subscribe@lists.finos.org to subscribe to our mailing list

[AlexKantor87]

Alex Kantor | Kosli

[carmithersh]

Carmit Hershman / JFrog

[aaronsearle]

Aaron Searle / Morgan Stanley

[vidhu-balad]

Vidhu Bala | Kosli

[petermaddison]

Peter Maddison / Morgan Stanley

[joshbressers]

Josh Bressers / Anchore

[cavanap]

Paul Cavanagh | Adaptavist

[anupriya-goyal]

Anupriya Goyal (individual contributor)

[ksharm19]

Hi all I'm Vaibhav Sharma, a Cloud Data Platform Engineer with 10+ years operating regulated financial data infrastructure at a Fortune 500 financial institution. I've been working on embedding compliance controls commit traceability, approval gates, change record linkages directly into CI/CD pipelines as automated engineering decisions rather than manual checkpoints.
The agenda item on Testing Evidence and Toolchain Inventory particularly resonates with my production experience. In our environment, testing evidence is generated automatically as a byproduct of the pipeline run rather than captured manually happy to share how we approached this if useful to the group.
Looking forward to contributing to this SIG.