Content library
NSM ICT Security Principles (Norway)
2.1.5: Use a secure software development method

How to fill the requirement

NSM ICT Security Principles (Norway)

2.1.5: Use a secure software development method

Task name
Priority
Status
Theme
Policy
Other requirements
Built in and default cyber security in system development (Security by design)
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
2
requirements

Examples of other requirements this task affects

2.1.5: Use a secure software development method
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Built in and default cyber security in system development (Security by design)
1. Task description

The organization must create procedures that by default cyber security and security requirements are considered from the start when developing and designing new systems, digital services or business processes.

This is called the principle of built-in and default security (security by design). As a result of this approach, the design documentation should clearly indicate what measures are taken to ensure cyber security.

Automated secure code deployment and release
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
3
requirements

Examples of other requirements this task affects

2.1.5: Use a secure software development method
NSM ICT-SP
2.1.8: Maintain the software code developed/used by the organisation
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Automated secure code deployment and release
1. Task description

The organization must define the means for a secure software deployment strategy. Means should be automated if possible.

Designing Secure Software Development Life Cycle(SSDLC) process
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
5
requirements

Examples of other requirements this task affects

PR.IP-2: A System Development Life Cycle
NIST
PR.IP-2: A System Development Life Cycle to manage systems is implemented.
CyFun
2.1.5: Use a secure software development method
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Designing Secure Software Development Life Cycle(SSDLC) process
1. Task description

The organization shall define and implement a Secure Software Development Life Cycle (SSDLC) process in software development.

The first step in the SSDLC process should be to define security requirements that ensure that security considerations become integrated into the services being developed right from the creation phase.

It is recommended that the SSDLC process include at least the following steps:

  • A - Training
  • B - Description of the requirements
  • C - Design
  • D - Development
  • E - Security testing
  • F - Publication
  • G - Responding to issues
Guidelines for secure development
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
15
requirements

Examples of other requirements this task affects

14.2.1: Secure development policy
ISO27 Full
14.2.5: Secure system engineering principles
ISO27 Full
TEK-14: Ohjelmistojen turvallisuuden varmistaminen
Julkri
8.25: Secure development life cycle
ISO27k1 Full
8.27: Secure system architecture and engineering principles
ISO27k1 Full
See all related requirements and other information from tasks own page.
Go to >
Guidelines for secure development
1. Task description

The general rules for secure development work have been drawn up and approved by the development managers. The implementation of the rules is monitored in software development in the organization and the rules are reviewed at least yearly.

The safe development policy may include e.g. the following things:

  • safety requirements of the development environment
  • instructions for secure coding of the programming languages used
  • safety requirements at the design stage of properties or projects
  • secure software repositories
  • version control security requirements
  • the skills required from developers to avoid, discover and fix vulnerabilities
  • compliance with secure coding standards

Compliance with the rules of secure development may also be required of key partners.

Regular critical code identification and verification
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
10
requirements

Examples of other requirements this task affects

14.2.3: Technical review of applications after operating platform changes
ISO27 Full
14.2.5: Secure system engineering principles
ISO27 Full
14.2.9: System acceptance testing
ISO27 Full
8.27: Secure system architecture and engineering principles
ISO27k1 Full
21.2.e: Secure system acquisition and development
NIS2
See all related requirements and other information from tasks own page.
Go to >
Regular critical code identification and verification
1. Task description

The definition of security-critical code for the various services is maintained. New parts of the critical code are constantly being identified and new updates are being checked particularly closely for changes to the critical code. The aim is to keep the likelihood of security vulnerabilities to a minimum.

Management process for software updates
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Update and patch management
8
requirements

Examples of other requirements this task affects

12.6.1: Management of technical vulnerabilities
ISO27 Full
SUM: Security update management
Cyber Essentials
8.8: Management of technical vulnerabilities
ISO27k1 Full
Article 9b: Prevention
DORA
PR.MA-1: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.
CyFun
See all related requirements and other information from tasks own page.
Go to >
Management process for software updates
1. Task description

Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.

No items found.

Universal cyber compliance language model: Comply with confidence and least effort

In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.

Security frameworks tend to share the common core. All frameworks cover basic topics like risk management, backup, malware, personnel awareness or access management in their respective sections.
Cyberday’s universal cyber security language technology creates you a single security plan and ensures you implement the common parts of frameworks just once. You focus on implementing your plan, we automate the compliance part - for current and upcoming frameworks.
Start your free trial
1.1 (MIL2): Manage IT and OT Asset Inventory
C2M2: MIL1
1.1 (MIL3): Manage IT and OT Asset Inventory
C2M2: MIL1
1.1.1: Availability of information security policies
TISAX
1.1.1: Identify the organisation’s strategy and priorities
NSM ICT-SP
1.1.2: Identify the organisation’s structures and processes for security management
NSM ICT-SP
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
1.1.4: Identify the organisation’s tolerances for ICT risk
NSM ICT-SP
1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions
NSM ICT-SP
1.1.6: Identify information processing and data flow
NSM ICT-SP
1.2 (MIL2): Manage Information Asset Inventory
C2M2: MIL1
1.2 (MIL3): Manage Information Asset Inventory
C2M2: MIL1
1.2.1: Establish a process to identify devices and software in use at the organisation
NSM ICT-SP
1.2.1: Scope of Information Security management
TISAX
1.2.2: Establish organisational guidelines for approved devices and software
NSM ICT-SP
1.2.2: Information Security Responsibilities
TISAX
1.2.3: Identify devices in use at the organisation
NSM ICT-SP
1.2.3: Information Security requirements in projects
TISAX
1.2.4: Definition of responsibilities with service providers
TISAX
1.2.4: Identify the software in use at the organisation
NSM ICT-SP
1.2: Manage Information Asset Inventory
C2M2: MIL1
1.3 (MIL2): Manage IT and OT Asset Configuration
C2M2: MIL1
1.3 (MIL3): Manage IT and OT Asset Configuration
C2M2: MIL1
1.3.1: Identification of information assets
TISAX
1.3.1: Identify the users of the information systems
NSM ICT-SP
1.3.2: Classification of information assets
TISAX
1.3.2: Identify and define the different user categories
NSM ICT-SP
1.3.3: Identify roles and responsibilities linked especially to ICT security
NSM ICT-SP
1.3.3: Use of approved external IT services
TISAX
1.3.4: Use of approved software
TISAX
1.3: Manage IT and OT Asset Configuration
C2M2: MIL1
1.4 (MIL2): Manage Changes to IT and OT Assets
C2M2: MIL1
1.4 (MIL3): Manage Changes to IT and OT Assets
C2M2: MIL1
1.4.1: Management of Information Security Risks
TISAX
1.4: Manage Changes to IT and OT Assets
C2M2: MIL1
1.5 (MIL1): Management Activities for the ASSET domain
C2M2: MIL1
1.5 (MIL2): Management Activities for the ASSET domain
C2M2: MIL1
1.5 (MIL3): Management Activities for the ASSET domain
C2M2: MIL1
1.5.1: Assessment of policies and requirements
TISAX
1.5.2: External review of ISMS
TISAX
1.5: Management Activities for the ASSET domain
C2M2: MIL1
1.6.1: Reporting of security events
TISAX
1.6.2: Management of reported events
TISAX
1.6.3: Crisis preparedness
TISAX
10 §: Johdon vastuu
KyberTL
10. Processing of personal data relating to criminal convictions and offences
GDPR
10.1 (MIL2): Establish Cybersecurity Program Strategy
C2M2: MIL1
10.1 (MIL3): Establish Cybersecurity Program Strategy
C2M2: MIL1
10.1.1: Policy on the use of cryptographic controls
ISO27 Full
10.1.2: Key management
ISO27 Full
10.1.2: Key management
ISO 27017
10.1: Continuous improvement
ISO27k1 Full
10.1: Cryptographic controls
ISO27 Full
10.1: Cryptographic controls
ISO 27017
10.1: Establish Cybersecurity Program Strategy
C2M2: MIL1
10.2 (MIL2): Establish and Maintain Cybersecurity Program
C2M2: MIL1
10.2 (MIL3): Establish and Maintain Cybersecurity Program
C2M2: MIL1
10.2: Establish and Maintain Cybersecurity Program
C2M2: MIL1
10.2: Non-conformity and corrective action
ISO27k1 Full
10.3 (MIL1): Management Activities for the PROGRAM domain
C2M2: MIL1
10.3 (MIL2): Management Activities for the PROGRAM domain
C2M2: MIL1
10.3 (MIL3): Management Activities for the PROGRAM domain
C2M2: MIL1
10.3: Management Activities for the PROGRAM domain
C2M2: MIL1
10: Cryptography
ISO27 Full
10: Cryptography
ISO 27017
10: Cybersecurity Program Management (PROGRAM)
C2M2: MIL1
10: Prosessi väärinkäytöksiin reagoimiseksi
Sec overview
11 §: Poikkeamailmoitukset viranomaiselle
KyberTL
11. Processing which does not require identification
GDPR
11.1.1: Physical security perimeter
ISO27 Full
11.1.2: Physical entry controls
ISO27 Full
11.1.3: Securing offices, rooms and facilities
ISO27 Full
11.1.4: Protecting against external and environmental threats
ISO27 Full
11.1.5: Working in secure areas
ISO27 Full
11.1.6: Delivery and loading areas
ISO27 Full
11.1: Secure areas
ISO27 Full
11.2.1: Equipment siting and protection
ISO27 Full
11.2.2: Supporting utilities
ISO27 Full
11.2.3: Cabling security
ISO27 Full
11.2.4: Equipment maintenance
ISO27 Full
11.2.5: Removal of assets
ISO27 Full
11.2.6: Security of equipment and assets off-premises
ISO27 Full
11.2.7: Secure disposal or re-use of equipment
ISO27 Full
11.2.7: Secure disposal or re-use of equipment
ISO 27017
11.2.8: Unattended user equipment
ISO27 Full
11.2.9: Clear desk and clear screen policy
ISO27 Full
11.2: Equipment
ISO27 Full
11.2: Equipment
ISO 27017
11: Digiturvan mittarien määrittäminen
Sec overview
11: Physical and environmental security
ISO27 Full
11: Physical and environmental security
ISO 27017
12 §: Luotettavuutta edellyttävien tehtävien tunnistaminen ja luotettavuudesta varmistuminen
TiHL
12 §: Poikkeamaa koskeva väliraportti
KyberTL
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
12.1.1: Documented operating procedures
ISO27 Full
12.1.2: Change management
ISO27 Full
12.1.3: Capacity management
ISO27 Full
12.1.4: Separation of development, testing and operational environments
ISO27 Full
12.1: Operational procedures and responsibilities
ISO27 Full
12.2.1: Controls against malware
ISO27 Full
12.2: Protection from malware
ISO27 Full