PW.1.2 Track and maintain the software’s security requirements, risks, and design decisions.

Statement

Track and maintain the software’s security requirements, risks, and design decisions.

Example 1:

Record the response to each risk, including how mitigations are to be achieved and what the rationales are for any approved exceptions to the security requirements. Add any mitigations to the software’s security requirements.

Example 2:

Maintain records of design decisions, risk responses, and approved exceptions that can be used for auditing and maintenance purposes throughout the rest of the software life cycle.

Example 3:

Periodically re-evaluate all approved exceptions to the security requirements, and implement changes as needed.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final