Application security controls, mapped across frameworks.

From a day-to-day perspective of requirements for Secure Software Development Practices (SSDP), there are “industry-recognized secure practices” that require secure software development. These frameworks impact nearly every organization, regardless of the industry it serves.

Study the SCA-BoK

✓ EO 14028

✓ PCI DSS v4

✓ CIS v8

✓ CMMC

What This Page Covers

The most common application security controls — in one place.

This page identifies the most common application security controls from leading cybersecurity frameworks. These requirements may come in the form of statutory, regulatory or contractual obligations for an organization to comply with.

Use this reference to:

Understand what's expected of secure software development across compliance regimes
Map your organization's existing controls to multiple frameworks at once
Build evidence packages for audits, attestations, and SDO/CODE applications

By Framework

Application security controls by source.

Selected controls below — see the SCA-BoK for the comprehensive mapping.

Executive Order

EO 14028, Sec. 4 — Software Supply Chain Security

Selected requirements for enhancing software supply chain security:

(A)Using administratively separate build environments.
(D)Documenting and minimizing dependencies on enterprise products that are part of the environments used to develop, build, and edit software.
(F)(ii)Generating and, when requested by a purchaser, providing artifacts that demonstrate conformance to the processes set forth in subsection (e)(i) of this section.
(F)(iii)Employing automated tools, or comparable processes, to maintain trusted source code supply chains, thereby ensuring the integrity of the code.
(F)(ix)Attesting to conformity with secure software development practices.
(F)(x)Ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software used within any portion of a product.

Payment Card Industry

PCI DSS v4

Selected requirements for bespoke and custom software development:

6.2.2Software development personnel working on bespoke and custom software are trained at least once every 12 months on software security relevant to their job function and development languages, including secure software design and secure coding techniques.
6.2.3Bespoke and custom software is reviewed prior to being released into production or to customers, to identify and correct potential coding vulnerabilities. Code reviews ensure code is developed according to secure coding guidelines and look for both existing and emerging software vulnerabilities.
6.2.4Software engineering techniques are defined and in use to prevent or mitigate common software attacks (injection, XSS/CSRF, business logic abuse, access control bypass, cryptographic weakness, and high-risk vulnerabilities).
6.3.1Security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including CERT alerts.
6.3.2An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software, is maintained to facilitate vulnerability and patch management.
6.5.6Test data and test accounts are removed from system components before the system goes into production.

Center for Internet Security

CIS v8 — Application Software Security

16.1Establish and Maintain a Secure Application Development Process.
16.2Establish and Maintain a Process to Accept and Address Software Vulnerabilities.
16.7Use Standard Hardening Configuration Templates for Application Infrastructure.
16.9Train Developers in Application Security Concepts and Secure Coding.
16.10Apply Secure Design Principles in Application Architectures.
16.11Leverage Vetted Modules or Services for Application Security Components.

Department of Defense

CMMC — Selected Controls

3.4.1Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
3.13.2Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
3.13.13Control and monitor the use of mobile code.

Additional Frameworks Referenced

SSDP requirements appear everywhere.

Beyond EO 14028, PCI DSS, CIS, and CMMC, secure software development requirements show up across most major cybersecurity frameworks. The SCA-BoK references the following.

NIST SP 800-218 (SSDF)

NIST SP 800-53

NIST SP 800-171

NIST SP 800-160

NIST SP 800-161

ISO 27002

SOC 2

HIPAA Security Rule

GDPR Art. 25

OWASP ASVS

OWASP Top Ten

SOC for Cybersecurity