6.2.3 For outsourced development of network and information systems, the relevant entities shall also …

Requirement

For outsourced development of network and information systems, the relevant entities shall also apply the policies and procedures referred to in points 5 and 6.1.

Guidance

• Align the secure development rules with the security testing policy (Annex to the regulation, point 6.5) and procedures and with the secure acquisition of ICT services, systems or product processes (Annex to the regulation, point 6.1).
• Communicate the internal development rules with the relevant personnel from outsourced development.
• Hold regular cross-organisational unit meetings during all phases of the development life cycle.

Examples of evidence

• Comparison of the secure development rules with the security-testing policy and with the secure acquisition of ICT services, systems or product processes, checking whether the security requirements are set consistently in all these documents.
• Evidence of communicating the internal development rules with relevant personnel from outsourced development.
• Records or minutes from cross organisational unit meetings where the development of a network and information system, including software, was discussed.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -