G.2.2 Secure SDLC checks
Control Details
Objective
Criteria throughout the SDLC are used to check the software's security during development.
Definition
Define criteria for a secure SDLC and associated software security checks that indicate how effectively software, including AI models, resulting from the SDLC meets the organization's expectations. These checks include key performance indicators (KPI), vulnerability severity scores, and security checks included in the 'definition of done' in an agile process and may be used for go/no-go decisions. The use of automated tools aids thoroughness, objectivity, and efficiency of these checks.
Assessment Questions
- What kind of criteria for security checks has been established, such as for security testing results?
- How can these checks indicate if security practices are being used and secure software is being developed?
- How are these checks tracked through the SDLC?
- Are the checks automated or manual?