P.1.1 Product security requirements
Control Details
Objective
Identify and document security requirements for organization-developed software, including AI models
Definition
Identify and document security requirements for organization-developed software, including AI models, including risk-reducing software architecture and design choices, security patterns, and translating compliance constraints to requirements. Examples include using memory-safe languages and secure frameworks, isolation and sandboxing component strategies, code modularity, security features, secure-by-design components, application containers, and product features that aid in secure deployment, operation, and maintenance. Containers can be used as a strategy for tighter coupling of an application and its dependencies, immutability, and some isolation benefits. Maintain these requirements over time.
Assessment Questions
- How are risk-reducing security architecture and design requirements for products considered and developed?
- Which of the following strategies are considered: the use of memory-safe languages, secure frameworks, isolation, acceptance testing, and sandboxing?
- How are completion and adherence tracked?