+Static Code Analysis

Static Code Analysis

Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ static code analysis tools to identify and remediate common flaws and document the results of the analysis.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Free static analysis (e.g., GitHub CodeQL, SonarQube Community, Semgrep)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ SAST in CI/CD (e.g., SonarQube, Semgrep, CodeQL)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ SAST integrated in CI/CD with defined severity thresholds (e.g., SonarQube, Semgrep, Checkmarx)
∙ Findings tracked to closure

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise SAST platform (e.g., Checkmarx, Veracode, Snyk Code, GitHub Advanced Security)
∙ Policy gates on critical findings
∙ Developer remediation guidance

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise application security testing platform with SAST across all pipelines
∙ Centralized vulnerability management for code findings
∙ Metrics and SLA-driven remediation

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218 and NIST SP 800-160).
▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.
▪ Developers of TAAS are required to employ static code analysis tools to identify and remediate common flaws, documenting the results of the analysis before the application is cleared for production usage.

Level 3 Well Defined

Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.
▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution and software testing tools).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ static code analysis tools to identify and remediate common flaws and document the results of the analysis.

Level 4 Quantitatively Controlled

Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1. Ħarsa ġenerali

Titlu	Standard

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti
Sors	Rekwiżit

3. Regolamenti relatati

Regolamenti

EULAW

Artikolu 28 8

8. Għas-servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti, l-entitajiet finanzjarji għandhom jistabbilixxu strateġiji ta’ ħruġ. L-istrateġiji ta’ ħruġ għandhom iqisu r-riskji li jistgħu jfiġġu fil-livell ta’ fornituri terzi ta’ servizzi tal-ICT, b’mod partikolari l-falliment possibbli min-naħa tagħhom, deterjorament tal-kwalità tas-servizzi tal-ICT ipprovduti, kwalunkwe tfixkil fl-operat minħabba forniment mhux xieraq jew li ma sarx ta’ servizzi tal-ICT jew kwalunkwe riskju materjali li jirriżulta b’rabta mal-użu xieraq u kontinwu tas-servizz tal-ICT rispettiv, jew it-terminazzjoni tal-arranġamenti kuntrattwali ma’ fornituri terzi ta’ servizzi tal-ICT fi kwalunkwe waħda miċ-ċirkostanzi elenkati fil-paragrafu 7.

L-entitajiet finanzjarji għandhom jiżguraw li jkunu jistgħu joħorġu mill-arranġamenti kuntrattwali mingħajr:

(a)	tfixkil fl-attivitajiet tal-operat tagħhom,

(b)	limitazzjoni tal-konformità mar-rekwiżiti regolatorji,

(c)	detriment għall-kontinwità u l-kwalità tas-servizzi provduti lill-klijenti.

Il-pjanijiet ta’ ħruġ għandhom ikunu komprensivi, dokumentati u, f’konformità mal-kriterji li jinsabu fl-Artikolu 4(2), għandhom jiġu ttestjati biżżejjed u rieżaminati perjodikament.

L-entitajiet finanzjarji għandhom jidentifikaw soluzzjonijiet alternattivi u jiżviluppaw pjanijiet ta’ tranżizzjoni li jippermettulhom ineħħu l-funzjonijiet u s-servizzi tal-ICT ikkuntrattati u d-data rilevanti mingħand il-fornitur terz ta’ servizzi tal-ICT u li jittrasferuhom b’mod sigur u integrali lil fornituri alternattivi jew jinkorporawhom mill-ġdid internament.

L-entitajiet finanzjarji għandu jkollhom stabbiliti miżuri ta’ kontinġenza xierqa biex iżommu l-kontinwità tal-operat fil-każ li jseħħu ċ-ċirkostanzi msemmija fl-ewwel subparagrafu.