6.2.1 Bespoke and custom software are developed securely, as follows: • Based on industry standards and/or best practices for secure development. • In accordance with PCI DSS (for example, secure authentication and logging). • Incorporating
Bespoke and custom software are developed securely, as follows: • Based on industry standards and/or best practices for secure development. • In accordance with PCI DSS (for example, secure authentication and logging). •.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence information security is considered at each stage of the development life cycle, not only at test · Source control / CI pipeline
governing documentDocuments that govern the control
- Documented software development procedures showing development is based on named industry standards or practices for secure development · Policy repository / GRC workspace
- Evidence the procedures require PCI DSS aligned outcomes such as secure authentication and logging in bespoke and custom software · Policy repository / GRC workspace
- Design or requirements artefacts from a real project showing security considered during design · Policy repository / GRC workspace
- Records of review or approval confirming software was developed under these procedures · Policy repository / GRC workspace
First move
Common gaps auditors find
- Secure development claimed from a scanning step in the pipeline, with no security consideration during requirements and design
- Standard named in the procedure with no mapping to what developers actually do
- Bespoke software from third parties developed outside the organisation's procedures with no equivalent imposed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.1.2 Roles and responsibilities for performing activities in Requirement 6 are documented, assigned, and understood · 6.2.2 Software development personnel working on bespoke and custom software are trained at least once every 12 months as follows: • On software security relevant to their job function and development languages. • Including secure