PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

Threats Addressed:

Subcategory is new to this version of the framework and incorporates the following item from the previous version: PR.IP-2: A System Development Life Cycle to manage systems is implemented.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Protect all components of organization-developed software from tampering and unauthorized access

Ex2: Secure all software produced by the organization, with minimal vulnerabilities in their releases

Ex3: Maintain the software used in production environments, and securely dispose of software once it is no longer needed

NIST Special Publication 800-53 Revision 5.2.0

SA-3: System Development Life Cycle

Acquire, develop, and manage the system using [Assignment: organization-defined system-development life cycle] that incorporates information security and privacy considerations; Define and document information security and privacy roles and responsibilities throughout the system development life cycle; Identify individuals having information security and privacy roles and responsibilities; and Integrate the organizational information security and privacy risk management…

SA-8: Security and Privacy Engineering Principles

Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and privacy engineering principles].

SA-10: Developer Configuration Management

Require the developer of the system, system component, or system service to: Perform configuration management during system, component, or service [Assignment (one or more): design, development, implementation, operation, disposal]; Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items]; Implement only organization-approved changes to the system, component, or service; Document approved changes…

SA-11: Developer Testing and Evaluation

Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: Develop and implement a plan for ongoing security and privacy control assessments; Perform [Assignment (one or more): unit, integration, system, regression] testing/evaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];…

SA-15: Development Process, Standards, and Tools

Require the developer of the system, system component, or system service to follow a documented development process that: Explicitly addresses security and privacy requirements; Identifies the standards and tools used in the development process; Documents the specific tool options and tool configurations used in the development process; and Documents, manages, and ensures the integrity of…

SA-17: Developer Security and Privacy Architecture and Design

Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: Is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture; Accurately and completely describes the required security and privacy functionality, and the allocation of controls…

SA-24: Design For Cyber Resiliency

Design organizational systems, system components, or system services to achieve cyber resiliency by: Defining the following cyber resiliency goals: [Assignment: organization-defined cyber resiliency goals]. Defining the following cyber resiliency objectives: [Assignment: organization-defined cyber resiliency objectives]. Defining the following cyber resiliency techniques: [Assignment: organization-defined cyber resiliency techniques]. Defining the following cyber resiliency implementation approaches: [Assignment: organization-defined…

NIST SP 800-171 Revision 3.0

03.16.01: Security Engineering Principles

Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined systems security engineering principles].

Cloud Controls Matrix v4.0

AIS-04: Secure Application Design and Development

Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.

AIS-06: Automated Secure Application Deployment

Establish and implement strategies and capabilities for secure, standardized, and compliant application deployment. Automate where possible.

AIS-07: Application Vulnerability Remediation

Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.

DSP-07: Data Protection by Design and Default

Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

IVS-06: Segmentation and Segregation

Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.

Critical Security Controls Version 8.1

16.1: Establish and Maintain a Secure Application Development Process

Establish and maintain a secure application development process. In the process, address such items as: secure application design standards, secure coding practices, developer training, vulnerability management, security of third-party code, and application security testing procedures. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.