Secure development
Building software with security designed in, tested and reviewed throughout the development lifecycle.
Overview
Frameworks such as the NIST Secure Software Development Framework and standards such as PCI DSS require secure coding, testing and change management.
It connects most directly to NIST SP 800 series, PCI DSS and Cybersecurity.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Insecure code becomes a compliance and liability problem.
Who it affects
Software companies and any firm developing its own systems.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to Secure development. Select one to open it.
What to do about it
- 1Define the owner, frequency, data and pass condition.
- 2Automate the test on source data where you can.
- 3Capture evidence on every run, including exceptions.
- 4Review exceptions and failures and record the decision.
From requirement to evidence.
Secure development controls are crosswalked across frameworks so one test satisfies several audits.
Request early access →