Crossfoot
Crossfoot / Controls / Secure software development
Draft v0.1.05 of 6 frameworks

Secure software development

Security is built into the development lifecycle: secure coding, code review, testing and environment separation.

Where it appears

SOC 2
CC8.1Changes are developed, tested and approved
PCI DSS 4.0
6.2Bespoke and custom software is developed securely
6.4Public-facing web applications are protected against attacks
NIST CSF 2.0
PR.PS-06Secure software development practices are integrated and their performance monitored
ISO 27001:2022
A.8.25Secure development life cycle
A.8.26Application security requirements
A.8.28Secure coding
A.8.29Security testing in development and acceptance
A.8.31Separation of development, test and production environments
HIPAA Security Rule
no direct requirement
NIST 800-53 r5
SA-3System development life cycle
SA-8Security and privacy engineering principles
SA-11Developer testing and evaluation

No direct HIPAA Security Rule citation.

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Secure development policy / SDLC standard
  • Code review or pull-request approval evidence
  • SAST/DAST/dependency scan results and remediation tracking
  • Developer security training records
  • Evidence of separation of development, test and production environments

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0NIST CSF 2.0 to ISO 27001:2022NIST CSF 2.0 to NIST 800-53 r5