--- title: "FINOS SDLC Governance Working Group: Building the Future of Software Delivery Controls" description: Building on the success of the Common Cloud Controls and the AI Governance Framework, this initiative aims to develop a shared, composable, and technology-agnostic vocabulary for SDLC controls—a common language that the entire industry can adopt and build upon. image: https://www.finos.org/hubfs/Community%20Blog/2025-10-14%20-%20Kosli%20Blog%20FINOS%20SDLC.png --- [![FINOS](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/finos-logo.png?width=543&height=126&name=finos-logo.png "FINOS")](https://finos.org) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) ![Community Blog](https://www.finos.org/hubfs/10.04.19.FINOS_WebsiteBanners_3.png) # Community Blog # FINOS SDLC Governance Working Group: Building the Future of Software Delivery Controls October 14, 2025 [Mike Long](https://www.finos.org/blog/author/mike-long) **A New Initiative for Standardized Software Governance** On June 23rd, the day before OSFF London, Deutsche Bank, Morgan Stanley, and Kosli came together to establish a working group to create a standardized framework for software delivery governance that could transform how financial institutions define their SDLCs. Building on the success of the Common Cloud Controls and the AI Governance Framework, this initiative aims to develop a shared, composable, and technology-agnostic vocabulary for SDLC controls—a common language that the entire industry can adopt and build upon. *![2025-10-14 - Kosli Blog FINOS SDLC](https://www.finos.org/hs-fs/hubfs/Community%20Blog/2025-10-14%20-%20Kosli%20Blog%20FINOS%20SDLC.png?width=536&height=300&name=2025-10-14%20-%20Kosli%20Blog%20FINOS%20SDLC.png)* ## **Why FINOS Is the Ideal Home** The Financial Services Open Source Foundation (FINOS) provides the perfect environment for this collaborative effort. With proven successes like the Common Cloud Controls project and the AI Governance Framework already under its belt, FINOS has demonstrated its ability to unite financial institutions around shared technical challenges. The strong interest from FINOS members in SDLC standardization makes this a natural next step in the foundation's evolution. ## **The Challenge: Making up Governance** Every regulated financial institution faces the same fundamental challenge: implementing robust SDLC controls to manage risk while maintaining development velocity. These controls typically include: - Code review processes - Security vulnerability scanning - Change approval workflows - Audit trail requirements - Deployment gates and checkpoints While essential for risk management, each control is redefined in every institution. **The Current State: Three Critical Flaws** Today's SDLC frameworks suffer from three fundamental issues: **1. Vague Requirements** Controls are often written to cover vast, heterogeneous IT landscapes. The result is guidelines that are either too generic to be actionable or so specific they apply to only narrow use cases. **2. Baseless Standards** Without industry-wide benchmarks or shared rationales, it's difficult to justify controls internally to development teams or externally to auditors and regulators. **3. Subjective Implementation** The lack of structured frameworks means controls resist automation, standardization, and systematic improvement. What works for one team may be interpreted or evaluated completely differently by another. ## **The Vision: A Catalog of Common Controls** The working group envisions a future where SDLC controls are: **Specific and Actionable** - Clear guidance with real-world examples - Practical implementation patterns - Measurable success and failure criteria **Canonical and Composable** - Industry-standard vocabulary - Modular controls that can be mixed and matched - Shared across institutions to reduce duplication **Objective and Testable** - Automated verification capabilities - Clear audit criteria - Consistent inspection standards ## **Join the Group** This initiative needs diverse perspectives to succeed. The working group will convene during the regular SDLC Governance Framework Working Group Meeting - Dev Ops Automation meetings, and your participation is important. Use [this link](https://zoom-lfx.platform.linuxfoundation.org/meeting/96292319760?password=a023f03e-c2aa-46fb-aae3-5d93c9d9664e&invite=true) to add the call to your calendar! **How You Can Contribute:** - Share your organization's SDLC challenges and successes - Provide feedback on proposed control frameworks - Help test and validate controls towards regulatory standards - Connect relevant stakeholders from your organization If you know someone in your organization who should be involved—whether from development, security, compliance, or risk management—please connect them with this project.  You can learn more in these github issues: - [Proposal: Software Development Lifecycle Common Controls Catalogue Framework #261](https://github.com/finos/devops-automation/issues/261) - [Final call closing the Automated Change Deployment WG and starting the SDLC WG](https://github.com/finos/devops-automation/issues/263) ## **Next Steps** The working group is actively forming and beginning to outline its charter. Early participants will have the opportunity to shape the direction of this critical industry initiative from the ground up. For more information or to join the working group, contact the FINOS SDLC Governance Working Group [mailing list](mailto:sdlc-framework+subscribe@lists.finos.org) or add the bi-weekly call [to your calendar](https://zoom-lfx.platform.linuxfoundation.org/meeting/96292319760?password=a023f03e-c2aa-46fb-aae3-5d93c9d9664e&invite=true). *Author: Mike Long, Kosli, CEO*   --- [**FINOS Good First Issues**](https://github.com/search?q=org%3Afinos+is%3Aopen+label%3A%22good+first+issue%22&unscoped_q=is%3Aopen+label%3A%22good+first+issue%22) - Looking for a place to contribute? Take a look at good first issues across FINOS projects and get your feet wet in the FINOS community. [State of Open Source in Financial Services Report 2024](https://www.finos.org/state-of-open-source-in-financial-services-2024) - Learn about what is really happening around open source in FSI. [**This Week at FINOS Blog**](https://finos.org/this-week-at-finos?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See what is happening at FINOS each week. [**FINOS Landscape**](https://landscape.finos.org/?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See our landscape of FINOS open source and open standard projects. [**Community Calendar**](https://calendar.finos.org)- Scroll through the calendar to find a meeting to join. [**FINOS Slack Channels**](https://finos.org/blog/finos-announces-new-community-slack?utm_campaign=20210428%20-%20FINOS%20All%20Community%20Call%20-%20Q2%202021&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - The FINOS Slack provides our Community another public channel to discuss work in FINOS and open source in finance more generally. [**Project Status Dashboard**](https://metrics.finos.org/goto/7bfcb03f027a1406c997d731d4715ea7?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See a live snapshot of our community contributors and activity. [**Events**](https://finos.org/news-and-events?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - Check out our upcoming events or email [**marketing@finos.org**](mailto:marketing@finos.org) if you'd like to partner with us or have an event idea. [**FINOS Open Source in Finance Podcasts**](https://anchor.fm/finos) - Listen and subscribe to the first open source in fintech and banking podcasts for deeper dives on our virtual "meetup" and other topics.   ### Share this: - [Tweet](https://twitter.com/share) [← Building the Future of Open Source in Finance with FINOS](https://www.finos.org/blog/building-the-future-of-open-source-in-finance-with-finos) [The Future of Compliance Will Be Built in the Open →](https://www.finos.org/blog/the-future-of-compliance-will-be-built-in-the-open) [![FINOS Logo](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/FINOS_Icon_Wordmark_White.png?width=689&height=971&name=FINOS_Icon_Wordmark_White.png "FINOS Logo")](https://www.finos.org/) [![Twitter logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/twitter-blue-social-panel.png)](https://twitter.com/finosfoundation) [![GitHub logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/github-black-social-panel.png)](https://finos.github.io) [![LinkedIn logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/linkedin-blue-social-panel.png)](https://www.linkedin.com/company/finosfoundation) [![SlideShare logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/slideshare-logo.png)](https://www.slideshare.net/finosfoundation) [![YouTube logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/youtube_logo-1.png)](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q) [Contact Us](https://www.finos.org/contact-us) [info@finos.org](mailto:info@finos.org) +1 (650) 665-9773 [Privacy | ](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple) ![](https://px.ads.linkedin.com/collect/?pid=537250&fmt=gif)