6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …

(a)

carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;

(b)

apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;

(c)

lay down security requirements regarding development environments;

(d)

establish and implement security testing processes in the development life cycle;

(e)

appropriately select, protect and manage security test data;

(f)

sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.