6.2.1 Before developing a network and information system, including software, the relevant entities shall …

Requirement

Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.

Guidance

• Take into account the entity’s policies and norms (if available) and industry-recognised standards when developing the rules for the secure development of network and information systems (51).

Examples of evidence

• Documented rules for the secure development of network and information systems which align with the entity’s policies and norms and are based on relevant standards and good practices.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -