+PO.4 Define and Use Criteria for Software Security Checks
---+PO.4.1 Define criteria for software security checks and track throughout the SDLC.
---+PO.4.2 Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.
|
PO.4 Define and Use Criteria for Software Security Checks
StatementHelp ensure that the software resulting from the SDLC meets the organization’s expectations by defining and using criteria for checking the software’s security during development.
1. Ħarsa ġenerali
| Titlu |
Standard |
|
PO.4.1 Define criteria for software security checks and track throughout the SDLC.
|
StatementDefine criteria for software security checks and track throughout the SDLC. Example 1:Ensure that the criteria adequately indicate how effectively security risk is being managed. Example 2:Define key performance indicators (KPIs), key risk indicators (KRIs), vulnerability severity scores, and other measures for software security. Example 3:Add software security criteria to existing checks (e.g., the Definition of Done in agile SDLC methodologies). Example 4:Review the artifacts generated as part of the software development workflow system to determine if they meet the criteria. Example 5:Record security check approvals, rejections, and exception requests as part of the workflow and tracking system. Example 6:Analyze collected data in the context of the security successes and failures of each development project, and use the results to improve the SDLC.
|
|
PO.4.2 Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.
|
StatementImplement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria. Example 1:Use the toolchain to automatically gather information that informs security decision-making. Example 2:Deploy additional tools if needed to support the generation and collection of information supporting the criteria. Example 3:Automate decision-making processes utilizing the criteria, and periodically review these processes. Example 4:Only allow authorized personnel to access the gathered information, and prevent any alteration or deletion of the information.
|
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|