PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.

Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.

Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.

Restrict the unauthorized addition, removal, update, and management of organization assets.

Define and implement a process to proactively roll back changes to a previous known good state in case of errors or security concerns.

Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.

Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.

Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.

Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.

Use a risk-based model for effective prioritization of vulnerability remediation using an industry recognized framework.

Define, document, apply and evaluate a list of approved services, applications and sources of applications (stores) acceptable for use by endpoints when accessing or storing organization-managed data.

Define and implement a process for the validation of the endpoint device's compatibility with operating systems and applications.

Manage changes to endpoint operating systems, patch levels, and/or applications through the company's change management processes.