SDLC Personnel & Training Management
- PO.2.1: Define and manage roles for SDLC
- PO.2.2: Provide role-based training for secure development
- PO.2.3: Obtain management commitment for secure development
Automated Toolchain Orchestration
- PO.3.1: Specify toolchains to mitigate identified risks
- PO.3.2: Deploy and maintain secure automated toolchains
- PO.3.3: Generate artifacts for secure development practices
Software Security Check Verification
- PO.4.1: Define criteria for software security checks
- PO.4.2: Implement mechanisms to safeguard criteria information
Secure Development Infrastructure Management
- PO.5.1: Protect environments involved in software development
- PO.5.2: Harden endpoints used for software development
Software Integrity Protection
- PS.1.1: Store code based on least privilege
- PS.2.1: Provide software release integrity verification mechanisms
Release Archive & Provenance Management
- PS.3.1: Securely archive files and supporting data
- PS.3.2: Share provenance data for software releases
Secure-by-Design Risk Architecture
- PW.1.1: Perform risk modeling for software security
- PW.1.2: Track security requirements and design decisions
- PW.1.3: Support standardized security features and services
- PW.2.1: Review software design for security compliance
Third-Party Component Governance
- PW.4.1: Maintain well-secured third-party software components
- PW.4.2: Create secure software components in-house
- PW.4.4: Verify third-party component compliance with requirements
Secure Coding & Build Hardening
- PW.5.1: Adhere to secure coding practices during creation
- PW.6.1: Use build tools to improve security
- PW.6.2: Configure build tools for executable security
Static & Dynamic Security Testing
- PW.7.1: Determine methods for human-readable code analysis
- PW.7.2: Perform code review for vulnerability detection
- PW.8.1: Determine methods for testing executable code
- PW.8.2: Perform functional and dynamic security testing
Secure Software Baseline Configuration
- PW.9.1: Define secure default settings for software
- PW.9.2: Implement and document secure software defaults
Continuous Vulnerability Monitoring & Disclosure
- RV.1.1: Gather information on vulnerabilities from sources
- RV.1.2: Review code to identify undetected vulnerabilities
- RV.1.3: Implement vulnerability disclosure and remediation policy
Vulnerability Response & Remediation
- RV.2.1: Analyze vulnerabilities to plan risk responses
- RV.2.2: Plan and implement vulnerability risk responses
SDLC Continuous Security Improvement
- RV.3.1: Analyze vulnerabilities to determine root causes
- RV.3.2: Identify root cause patterns over time
- RV.3.3: Review software for similar class vulnerabilities
- RV.3.4: Update SDLC process to prevent recurrence
