8.25 Secure development life cycle
Requires rules covering the secure development of both software and systems to be established and applied.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence of enforcement, such as pipeline gates that stop a release failing a security requirement · Source control / CI pipeline
periodic reviewEvidence produced at each review
- Evidence the rules apply to all development, including agile teams, integration work and vendor delivered code · Source control / CI pipeline
- Evidence of security activities at each stage, such as threat modelling, secure design review, code review and security testing · Source control / CI pipeline
- Records of developer security competence and training · Source control / CI pipeline
governing documentDocuments that govern the control
- The secure development rules covering the full lifecycle, from requirements through design, build, test and release · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Source control / CI pipeline on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Rules written for a delivery model no team uses, so they are ignored in practice
- Security activities defined as recommended rather than required, so they are the first thing dropped under deadline
- Contractor and vendor written code exempt from the rules that internal code must meet
- No gate, so the process depends entirely on individual discipline
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.24 Use of cryptography · 8.26 Application security requirements