6. Security in network and information systems acquisition, development and maintenance

Security in network and information systems acquisition, development and maintenance

1. Resumen

6.1 Security in acquisition of ICT services or ICT products

Mapping to standards and frameworks

ISO standard 27001:2022	A.5.21, A.5.23
NIST Cybersecurity Framework v2.0	GV.PO-02, GV.SC-06, ID.RA-09, ID.RA-10, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.7-01, Clause 7.14.2
CEN/TS 18026:2024	OIS-04, AM-03, DEV-02, DEV-07, PM-01
BE-CyFun®2023	BASIC: ID.GV-4.1 IMPORTANT: ID.RM-1.1, ID.GV-4.2, ID.SC-3.1, ID.SC-4.1, PR.IP-2.1, DE.CM-6.2 ESSENTIAL: ID.SC-2.2, ID.SC-3.2, ID.SC-4.2, ID.SC-3.3
FI-Kybermittari	THIRD-PARTIES-1, THIRD-PARTIES-2, ARCHITECTURE-4
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 12.1a, 12.1c, 12.1d, 12.1e, 12.2a, 12.2b Cybersecurity Handbook: Part B: 13.1, 13.2, 13.4, 13.5 Self-assessment tool: 14.1, 14.2, 14.4, 14.5
ENS-Royal Decree 311/2022	Article 19 Annex II: [op.pl.3] Acquisition of new components, [op.pl.5] Certified components, [op.ext.1] Contracting and service level agreements, [op.ext.2] Daily management, [op.exp.4] Security maintenance and updates
FR	3.A.1-IE/EE 5.A.1-EE 5.B.1-EE 16.1-EE 8.5-EE

6.2 Secure development life cycle

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.25, A.8.31
NIST Cybersecurity Framework v2.0	ID.AM-08, PR.PS-06, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.7-01, REQ-7.7-02, REQ-7.7-03, REQ-7.7-04, REQ-7.8-10
CEN/TS 18026:2024	OIS-04, CCM-04, CCM-06, DEV-01, DEV-03, DEV-04, DEV-05, DEV-06
BE-CyFun®2023	IMPORTANT: ID.GV-1.2, PR.IP-2.1 ESSENTIAL: PR.DS-7.1, PR.IP-2.2
FI-Kybermittari	ARCHITECTURE-4, THIRD-PARTIES-2
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 15a, 15b, 15c, 15d Cybersecurity Handbook: Part B: 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.10, 9.11, 9.12, 9.13, 9.14, 9.15, 9.16 Self-assessment tool: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 10.12
ENS-Royal Decree 311/2022	Article 36 Annex II: [mp.sw.1] IT Applications development, [mp.sw.2] Acceptance and commissioning, [mp.info.1] Personal data
FR	2.B.5-IE/EE 5.B.1-EE

6.3 Configuration management

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.9
NIST Cybersecurity Framework v2.0	PR.PS-01, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-6.3-08X, REQ-7.7-03, REQ-6.3-09X, REQ-7.7-08X, REQ-7.7-09X, REQ-7.7-10X
CEN/TS 18026:2024	OPS-21, PSS-03, PSS-04
BE-CyFun®2023	BASIC: PR.IP-4.1 IMPORTANT: ID.AM-3.2, PR.IP-1.1 ESSENTIAL: ID.SC-3.2, PR.DS-1.1, PR.IP-1.2, PR.IP-2.2, DE.CM-7.2
FI-Kybermittari	ASSET-3, ASSET-4, ARCHITECTURE-3, ARCHITECTURE-4
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 14a, 14b, 14c, 14d, 19h Cybersecurity Handbook: Part B: 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.12, 2.15 Self-assessment tool: 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.12, 3.13
ENS-Royal Decree 311/2022	Article 10, Article 20, Article 21, Article 30 Annex II: [op.exp.2] Security Configuration, [op.exp.3] Security Configuration Management
FR	10.B.2-IE/EE 11.B.7-EE 17.2-EE 19.1-EE 19.2-EE 19.3-EE

6.4 Change management, repairs and maintenance

Mapping to standards and frameworks

ISO standard 27001:2022	6.3, 8.1, A.7.13, A.8.32
NIST Cybersecurity Framework v2.0	ID.RA-07, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.7-03, REQ-7.7-04, REQ-7.7-07X
CEN/TS 18026:2024	ISP-03, CCM-01, CCM-02, CCM-03, CCM-04, CCM-05, CCM-06
BE-CyFun®2023	BASIC: ID.AM-1.1, ID.AM-2.1; ID.GV-1.1 IMPORTANT: ID.AM-1.2, ID.AM-2.2, ID.AM-4.1, ID.GV-1.2, PR.DS-6.1, PR.MA-1.2, PR.MA-1.3, PR.IP-3.1, RS.IM-2.1 ESSENTIAL: ID.AM-3.3, ID.AM-4.2, PR.IP-2.2, PR.IP-3.2, DE.CM-7.2
FI-Kybermittari	ASSET-4
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 16a, 16b Cybersecurity Handbook: Part B: 2.12
ENS-Royal Decree 311/2022	Annex II: [op.exp.5] Change Management
FR	2.C.2-IE/EE 5.A.1-EE

6.5 Security testing

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.29, A.8.33, A.8.34
NIST Cybersecurity Framework v2.0	ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.8-10, REQ-7.8-13, REQ-7.8-14X, REQ-7.8-17X, REQ-7.8-18X, REQ-7.8-19X
CEN/TS 18026:2024	ISP-02, OPS-19, DEV-01, DEV-04, DEV-06
BE-CyFun®2023	IMPORTANT: ID.BE-5.1, ID.SC-4.1, PR.IP-3.1, PR.P-4.2, PR.IP-7.3, PR.MA-1.3, RS.CO-1.1, RS.IM-1.2, RC.IM-1.1 ESSENTIAL: ID.RA-1.3, ID.SC-3.2, ID.SC-4.2, PR.DS-7.1, PR.IP-2.2, PR.IP-3.2, DE.DP-5.2
FI-Kybermittari	THREAT-1, THIRD-PARTIES-2
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 8a, 8b, 8c, 8d, 18.1a, 18.1b, 18.1c, 18.1d, 18.2a, 18.2b Cybersecurity Handbook: Part B: 14.4, 14.5, 9.13, 9.14 Self-assessment tool: 15.6, 15.7, 15.8, 15.9, 10.10, 10.11
ENS-Royal Decree 311/2022	Annex II: [op.nub.1] Cloud Service Protection, [op.cont.2] Continuity plan, [op.cont.3] Periodic tests, [op.exp.4] Security maintenance and updates, [op.exp.5] Change Management
FR	3.B.2-IE/EE 13.2-IE/EE 13.3-IE/EE 13.4-IE/EE 17.3-EE

6.6 Security patch management

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.31, A.8.32
NIST Cybersecurity Framework v2.0	PR.PS-02, DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.7-07X
CEN/TS 18026:2024	CCM-03, CCM-04, CCM-05, OPS-18
BE-CyFun®2023	BASIC: PR.MA-1.1 IMPORTANT: PR.MA-1.2, PR.IP-1.1 ESSENTIAL: ID.SC-3.2, PR.MA-1.7
FI-Kybermittari	ASSET-4, THREAT-1
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 17c, 17d Cybersecurity Handbook: Part B: 2.8 Self-assessment tool: 3.5, 3.6, 15.4
ENS-Royal Decree 311/2022	Article 21 Annex II: [op.exp.4] Security maintenance and updates
FR	5.A.1-EE 5.B.1-EE 5.B.2-IE/EE 5.B.3-IE/EE 5.B.4-IE/EE 5.B.5-EE 5.B.6-IE/EE 5.B.7-IE/EE 5.B.8-IE/EE 5.B.9-IE/EE 5.B.10-IE/EE 5.B.11-IE/EE

6.7 Network security

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.16, A.8.20
NIST Cybersecurity Framework v2.0	DE.CM-01, PR.IR-01, PR.PS-05, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	Clause 7.8
CEN/TS 18026:2024	PS-04, CS-01, CS-02, CS-03, CS-06, CS-07, CS-08, PSS-02
BE-CyFun®2023	BASIC: ID.RA-1.1, PR.AC-2.1, PR.AC-3.1, PR.AC-3.2, PR.AC-5.1, PR.AC-5.2, DE.CM-1.1, DE.CM-3.1 IMPORTANT: PR.AC-2.2, PR.AC-3.3, PR.AC-5.3, PR.AC-5.4, PR.AT-1.2, DE.CM-1.2, DE.CM-3.2 ESSENTIAL: ID.BE-1.2, PR.AC-2.4, PR.AC-5.5, DE.CM-1.3
FI-Kybermittari	ACCESS-1, ACCESS-2, ARCHITECTURE-1, ARCHITECTURE-2
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 19a, 19b, 19c, 19d, 19f, 19g, 19h, 19i, 19j, 19k Cybersecurity Handbook: Part B: 6.1, 6.2, 6.3, 6.8, 6.9, 6.10, 6.11, 6.12, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 6.19, 6.20, 6.21, 6.22, 6.23 Self-assessment tool: 7.1, 7.2, 7.3, 7.8, 7.9, 7.11, 7.12, 7.13, 7.14, 7.16, 7.17, 7.18, 7.19, 7.20, 7.21
ENS-Royal Decree 311/2022	Article 9, Article 10, Article 27, Annex II: [mp.com.1] Secure perimeter, [mp.com.2] Protection of confidentiality, [mp.com.3] Protection of integrity and authenticity
FR	3.A.1-IE/EE 5.B.3-IE/EE 7.A.2-EE 8.1-IE/EE 8.2-IE/EE 8.3-EE 8.5-EE 9.1-IE/EE 9.2-EE 9.3-IE/EE 9.4-EE 11.B.5-EE 19.10-EE

6.8 Network segmentation

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.22
NIST Cybersecurity Framework v2.0	PR.IR-01, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.8-02, REQ-7.8-03, REQ-7.8-04, REQ-7.8-05, REQ-7.8-06, REQ-7.8-07, REQ-7.8-08, REQ-7.8-09X, REQ-7.8-10
CEN/TS 18026:2024	IAM-09, CS-02, CS-04, CS-05
BE-CyFun®2023	BASIC: PR.AC-3.1, PR.AC-5.2 IMPORTANT: PR.AC-5.3, PR.AC-5.4, PR.IP-4.3 ESSENTIAL: ID.BE-5.2, PR.DS-7.1, PR.IP-3.2, PR.IP-4.5
FI-Kybermittari	ARCHITECTURE-1, ARCHITECTURE-2
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 19e, 19f, 19k Cybersecurity Handbook: Part B: 6.4, 6.5, 6.6, 6.7, 6.15 Self-assessment tool: 7.4, 7.5, 7.6, 7.7, 7.15
ENS-Royal Decree 311/2022	Annex II: [mp.com.4] Separation of information flows on the network
FR	7.A.1-IE/EE 7.A.2-EE 7.A.3-EE 7.A.4-EE 7.A.5-EE 7.A.6-EE 7.A.7-IE/EE

6.9 Protection against malicious and unauthorised software

Mapping to standards and frameworks

ISO standard 27001:2022	A.5.32, A.8.7
NIST Cybersecurity Framework v2.0	DE.CM-01, DE.CM-09, PR.PS-05, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.7-05, REQ-7.8-15X, REQ-7.8-16X
CEN/TS 18026:2024	OPS-04, OPS-05, CS-03
BE-CyFun®2023	BASIC: ID.AM-2.1, ID.RA-1.1, PR.PT-4.1, DE.CM-4.1 IMPORTANT: ID.AM-2.4, DE.CM-5.1 ESSENTIAL: ID.AM-2.5, PR.MA-1.6, PR.PT-2.3, DE.CM-4.2, DE.DP-5.2
FI-Kybermittari	ARCHITECTURE-2, ARCHITECTURE-3
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 20a, 20b, 20c, 20d, 20e Cybersecurity Handbook: Part B: 6.9, 6.10, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8, 7.9, 7,10 Self-assessment tool: 7.9, 7.10, 7.11, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10
ENS-Royal Decree 311/2022	Article 24 Annex II: [op.exp.6] Protection against harmful code
FR	5.B.1-EE 5.B.2-IE/EE 5.B.3-IE/EE 9.1-IE/EE 9.2-EE 9.3-IE/EE 9.4-EE 9.5-IE/EE 9.6-IE/EE 9.7-IE/EE 20.1-EE

6.10 Vulnerability handling and disclosure

Mapping to standards and frameworks

ISO standard 27001:2022	A.8.8
NIST Cybersecurity Framework v2.0	ID.RA-01, ID.RA-02, ID.RA-04, ID.RA-05, ID.RA-06, PR.PS-02, PR.PS-03, ID.RA-08, ID.RA-06, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1	REQ-7.8-13, REQ-7.8-14X, REQ-7.9.2-09X, REQ-7.9.2-10X, REQ-7.9.5-01X , REQ-7.9.5-02X
CEN/TS 18026:2024	OIS-03, OPS-17, OPS-18, OPS-19, OPS-20, OPS-21, DEV-06
BE-CyFun®2023	BASIC: ID.RA-1.1 IMPORTANT: ID.RA-1.2, ID.RA-2.1, DE.CM-8.1, DE.CM-8.2, DE.DP-4.1, RS.AN-5.1 ESSENTIAL: ID.AE-3.3, DE.DP-5.2, RS.AN-5.2
FI-Kybermittari	THREAT-1
EL- Ministerial decision 1689/2025	Ministerial decision 1689/2025: articles 5.2, 17a, 17b, 17e, 17f, 17g Cybersecurity Handbook: Part B: 14.1, 14.2, 14.3 Self-assessment tool: 15.1, 15.3, 15.4, 15.5
ENS-Royal Decree 311/2022	Article 8, Article 10, Article 21, Article 34 Annex II: [op.mon.3] Monitoring, [mp.s.2] Protection of web services and applications
FR	5.B.1-EE 5.B.2-IE/EE 5.B.3-IE/EE 5.B.4-IE/EE 5.B.5-EE 5.B.6-IE/EE 5.B.7-IE/EE 5.B.8-IE/EE 5.B.9-IE/EE 5.B.10-IE/EE 5.B.11-IE/EE 17.2-EE 17.3-EE 17.4-EE 17.5-EE 18.4-EE

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos
Fuente	Requisito

3. Regulaciones relacionadas

Regulaciones
Fuente	Regulación

Incidencias vinculadas

Vínculos
Tipo de vínculo	Incidencia
is related to	6. Security in network and information systems acquisition, development and maintenance (Article …

ENISA -