Secure acquisition, development and maintenance
Catalog reference
Manage the risks of acquiring ICT services and products that are critical to your systems, through their whole life cycle: set security requirements, update or replacement requirements, information on components and security functions, assurance, and validation of what is delivered. Set secure development rules for in-house and outsourced development covering every stage, with security requirements analysis, secure engineering and coding principles, secure development environments, security testing, and protected, sanitised test data. Set, document and maintain secure configurations of hardware, software, services and networks. Use change management for releases, changes and emergency changes, documenting and testing them against risk first. Keep a security testing policy with a documented method and recorded results, and a patch policy: apply patches within a reasonable time, test them, take them from trusted sources, and document any decision not to patch. Protect the network (documented architecture, access and communication controls, remote access, secure channels, secure transition to current protocols, email standards, DNS and routing hygiene), segment networks and zones by risk and separate production from development, protect against malicious and unauthorised software, and handle vulnerabilities: monitor information, scan, fix critical ones without delay, and set a disclosure procedure. Review each of these on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Narrative — how we satisfy this requirement
No narrative yet. Add one.
No policies are linked to this requirement yet. Link from a policy's Edit page.