Establish and Maintain a Secure Application Development Process
Description
Establish and maintain a secure application development process. In the process, address such items as: secure application design standards, secure coding practices, developer training, vulnerability management, security of third-party code, and application security testing procedures. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Application security platform with SAST, DAST, SCA, and developer training for secure software development
Veracode · Per-application subscription
Cloud-native application security platform with SAST, SCA, DAST, API security, and supply chain security testing
Checkmarx · Per-developer subscription
Application security testing suite with SAST (Coverity), SCA (Black Duck), and DAST for comprehensive AppSec
Synopsys · Per-developer subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Systemic Security Flaws in Internally Developed Applications
IntegrityMultiple applications developed in-house contain the same categories of vulnerabilities such as injection flaws and broken authentication because no secure development process defines coding standards or security requirements.
Vulnerable Third-Party Code Integrated Without Review
IntegrityDevelopers incorporate open-source libraries with known critical vulnerabilities into production applications because the development process has no requirements for vetting third-party code security.
Security Bypassed to Meet Release Deadlines
ConfidentialityApplications are rushed to production without any security testing because no formal secure development process mandates security gates in the release pipeline.
Vulnerabilities (When Safeguard Absent)
No Secure Software Development Lifecycle (SSDLC)
Without a secure development process, there are no defined standards for secure design, coding practices, vulnerability management, or security testing, resulting in applications with systemic security weaknesses.
No Security Requirements in Development Pipeline
Absence of a formalized process means security testing, code review, and vulnerability assessment are not required stages in the software release lifecycle.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Vulnerability scan reports showing scope and findings | Per scan cycle |
| Record | Vulnerability remediation tracking with SLA compliance metrics | Monthly |
| Record | Training completion records and compliance rates | Tracked continuously, reported quarterly |
| Document | Training content and curriculum documentation | Reviewed annually |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |