Requirement

6.2: Secure development life cycle

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.

2. For the purpose of point 6.2.1, the relevant entities shall:

carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;
apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
lay down security requirements regarding development environments;
establish and implement security testing processes in the development life cycle;
appropriately select, protect and manage security test data;
sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.

3. For outsourced development of network and information systems, the relevant entities shall also apply the policies and procedures referred to in points 5 and 6.1.

4. The relevant entities shall review and, where necessary, update their secure development rules at planned intervals.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

NIS2 Implementing Regulation

Other requirements of the framework

6.2: Secure development life cycle

Best practices

How to implement:

6.2: Secure development life cycle

This policy on

6.2: Secure development life cycle

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

2. For the purpose of point 6.2.1, the relevant entities shall:

carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;
apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
lay down security requirements regarding development environments;
establish and implement security testing processes in the development life cycle;
appropriately select, protect and manage security test data;
sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.

3. For outsourced development of network and information systems, the relevant entities shall also apply the policies and procedures referred to in points 5 and 6.1.

4. The relevant entities shall review and, where necessary, update their secure development rules at planned intervals.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

6.2: Secure development life cycle

Task name

Priority

Task completes