+6.2. Secure development life cycle
---+6.2.1. Before developing a network and information system, including software, the relevant …
---+6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
---+6.2.3. For outsourced development of network and information systems, the relevant entities shall …
---+6.2.4. The relevant entities shall review and, where necessary, update their secure development …
|
6.2. Secure development life cycle
6.2. Secure development life cycle
1. Panoramica
| Titolo |
Regolamentazione |
|
6.2.1. Before developing a network and information system, including software, the relevant …
|
|
6.2.1.
|
Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.
|
|
|
6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
|
|
6.2.2.
|
For the purpose of point 6.2.1, the relevant entities shall:
|
(a)
|
carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;
|
|
(b)
|
apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
|
|
(c)
|
lay down security requirements regarding development environments;
|
|
(d)
|
establish and implement security testing processes in the development life cycle;
|
|
(e)
|
appropriately select, protect and manage security test data;
|
|
(f)
|
sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.
|
|
|
|
6.2.3. For outsourced development of network and information systems, the relevant entities shall …
|
|
6.2.3.
|
For outsourced development of network and information systems, the relevant entities shall also apply the policies and procedures referred to in points 5 and 6.1.
|
|
|
6.2.4. The relevant entities shall review and, where necessary, update their secure development …
|
|
6.2.4.
|
The relevant entities shall review and, where necessary, update their secure development rules at planned intervals.
|
|
,
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Standard correlati
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Standard correlati
Ticket collegati
|