A.8.26 Application security requirements
Identify, specify and approve security requirements when developing or acquiring applications.
13
artefacts
2
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Change Management Approval Log · SIEM / log platform
- Automated Security Testing Results (SAST/DAST reports) · Document repository
periodic reviewEvidence produced at each review
- Management Review Minutes for Security Requirements · Policy repository / GRC workspace
- Developer Training Attendance Records on secure coding · HR system / LMS
- Third‑Party Risk Assessment Report · Vendor register / contract repository
governing documentDocuments that govern the control
- Application Security Requirements Specification Document · Document repository
- Functional Requirements Document with security annotations · Document repository
- Threat Modeling Report · Document repository
- Requirement Approval Sign‑off Sheet · Document repository
- Secure Development Lifecycle (SDL) Process Document · Policy repository / GRC workspace
- Traceability Matrix linking security requirements to code modules · Policy repository / GRC workspace
- Third‑Party Vendor Security Requirements Checklist · Vendor register / contract repository
- Contractual Security Clauses for Application Procurement · Vendor register / contract repository
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Security requirements not formally approved
- Missing requirements for third‑party components
- No traceability between requirements and implemented controls
- Outdated or incomplete threat modeling
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.8.25 Secure development life cycle · A.8.27 Secure system architecture and engineering principles