Content library
CIS 18 controls
16.1: Establish and Maintain a Secure Application Development Process

Requirement description

Establish and maintain a secure application development process. In the process, address such items
as: secure application design standards, secure coding practices, developer training, vulnerability
management, security of third-party code, and application security testing procedures. Review and
update documentation annually, or when significant enterprise changes occur that could impact
this Safeguard.

How to fill the requirement

CIS 18 controls

16.1: Establish and Maintain a Secure Application Development Process

Task name
Priority
Status
Theme
Policy
Other requirements
Guidelines for secure development
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
23
requirements

Examples of other requirements this task affects

Članak 30.1.e: Sigurnost u nabavi, razvoju i održavanju mrežnih i informacijskih sustava
NIS2 Croatia
9.3 §: Tietojärjestelmien hankinta ja kehittäminen
Kyberturvallisuuslaki
30 § 3.5°: L'acquisition, du développement et de la maintenance des réseaux et des systèmes d'information
NIS2 Belgium
2.1.5: Use a secure software development method
NSM ICT-SP
2.1.8: Maintain the software code developed/used by the organisation
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Guidelines for secure development
1. Task description

The general rules for secure development work have been drawn up and approved by the development managers. The implementation of the rules is monitored in software development in the organization and the rules are reviewed at least yearly.

The safe development policy may include e.g. the following things:

  • safety requirements of the development environment
  • instructions for secure coding of the programming languages used
  • safety requirements at the design stage of properties or projects
  • secure software repositories
  • version control security requirements
  • the skills required from developers to avoid, discover and fix vulnerabilities
  • compliance with secure coding standards

Compliance with the rules of secure development may also be required of key partners.

Designing Secure Software Development Life Cycle(SSDLC) process
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
8
requirements

Examples of other requirements this task affects

PR.IP-2: A System Development Life Cycle
NIST
PR.IP-2: A System Development Life Cycle to manage systems is implemented.
CyberFundamentals
2.1.5: Use a secure software development method
NSM ICT-SP
PR.PS-06: Secure software development practices
NIST 2.0
16.1: Establish and Maintain a Secure Application Development Process
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Designing Secure Software Development Life Cycle(SSDLC) process
1. Task description

The organization shall define and implement a Secure Software Development Life Cycle (SSDLC) process in software development.

The first step in the SSDLC process should be to define security requirements that ensure that security considerations become integrated into the services being developed right from the creation phase.

It is recommended that the SSDLC process include at least the following steps:

  • A - Training
  • B - Description of the requirements
  • C - Design
  • D - Development
  • E - Security testing
  • F - Publication
  • G - Responding to issues
Regular critical code identification and verification
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Secure development
17
requirements

Examples of other requirements this task affects

Članak 30.1.e: Sigurnost u nabavi, razvoju i održavanju mrežnih i informacijskih sustava
NIS2 Croatia
9.3 §: Tietojärjestelmien hankinta ja kehittäminen
Kyberturvallisuuslaki
30 § 3.5°: L'acquisition, du développement et de la maintenance des réseaux et des systèmes d'information
NIS2 Belgium
2.1.5: Use a secure software development method
NSM ICT-SP
2.1.8: Maintain the software code developed/used by the organisation
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Regular critical code identification and verification
1. Task description

The definition of security-critical code for the various services is maintained. New parts of the critical code are constantly being identified and new updates are being checked particularly closely for changes to the critical code. The aim is to keep the likelihood of security vulnerabilities to a minimum.

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.