how do major tech companies handle security review?

[afeld]

Questions:

• Do they have an equivalent of an ATO?
• Does it look like government's?
• How do they do it?
• What can we learn from them?

Running list of resources found:

• https://gsuite.google.com/learn-more/security/security-whitepaper/page-2.html
• https://www.microsoft.com/en-us/securityengineering/sdl/practices
• https://www.microsoft.com/en-us/itshowcase/securing-the-supply-chain-with-risk-based-assessments
• https://www.microsoft.com/en-us/itshowcase/changing-our-approach-to-information-security-at-microsoft
• https://newsroom.fb.com/news/2019/01/designing-security-for-billions/
• https://waterfrontoronto.ca/nbe/wcm/connect/waterfront/41979265-8044-442a-9351-e28ef6c76d70/18.10.15_SWT_Draft+Proposals+Regarding+Data+Use+and+Governance.pdf?MOD=AJPERES