+Policies for the development/procurement of information systems

Policies for the development/procurement of information systems

Policies and instructions with technical and organisational measures for the secure development of the cloud service are documented, communicated and provided in accordance with SP-01.
The policies and instructions contain guidelines for the entire life cycle of the cloud service and are based on recognised standards and methods with regard to the following aspects:
• Security in Software Development (Requirements, Design, Implementation, Testing and Verification);
• Security in software deployment (including continuous delivery); and
• Security in operation (reaction to identified faults and vulnerabilities).
Additonal CriteriaIn procurement, products are preferred which have been certified according to the "Common Criteria for Information Technology Security Evaluation" (short: Common Criteria CC) according Evaluation Assurance Level EAL 4. If noncertified products are to be procured for available certified products, a risk assessment is carried out in accordance with OIS-07.
Supplementary Information - About the CriteriaThe software provision can be carried out e.g. with Continuous Delivery methods.
Accepted standards and methods are, for example:
• ISO/IEC 27034; and
• OWASP Secure Software Development Lifecycle (S-SDLC).

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen