Developer Testing and Evaluation

frameworkNIST SP 800-53 Rev 5.2 sectionSA System and Services Acquisition csf 2.0ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-09 PR.PS-06 topicsSecure Development frameworks6 2 0

Official textRequire the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:
a. Develop and implement a plan for ongoing security and privacy control assessments;
b. Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];
c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
d. Implement a verifiable flaw remediation process; and
e. Correct flaws identified during testing and evaluation.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SA-11 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Crosswalk	Same topic: Secure Development 2 loosely related (not mappings) ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Loosely related Only shares CSF ID.RA-09: related, not a mapping
ISO 27001	A.8.25 A.8.26 A.8.28 A.8.29 A.8.30	Secure development life cycle; Application security requirements…	Crosswalk	Same topic: Secure Development NIST SP 800-53 → ISO 27001 mapping 5 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.IM-02, ID.RA-09: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-09: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping A.8.31 Separation of development, test and production environments Loosely related Only shares CSF PR.PS-06: related, not a mapping
CIS v8.1	CIS 16.1 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities…	Crosswalk	Same topic: Secure Development 13 loosely related (not mappings) CIS 7.1 Establish and Maintain a Vulnerability Management Process Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.7 Remediate Detected Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 9.3 Maintain and Enforce Network-Based URL Filters Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 13.10 Perform Application Layer Filtering Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 16.10 Apply Secure Design Principles in Application Architectures Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 5 more in the downloads
SOC 2	CC8.1	Change management for infrastructure, data and software	Editorial	Same topic: Secure Development (editorial pick) 3 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.PS-06: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF ID.RA-09: related, not a mapping
PCI DSS	6.2.2 6.2.3 6.2.1	Developers trained in secure software development; Custom code reviewed before release…	Crosswalk	Same topic: Secure Development 9 loosely related (not mappings) 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.IM-02, ID.RA-01, PR.PS-06: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF ID.RA-01, PR.PS-06: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF ID.RA-09, PR.PS-06: related, not a mapping 11.3.1 Internal vulnerability scans every three months Loosely related Only shares CSF ID.IM-03, ID.RA-01: related, not a mapping 11.3.2 External ASV scans every three months Loosely related Only shares CSF ID.IM-03, ID.RA-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.RA-01: related, not a mapping 9.5.1.1 Inventory of POI devices kept Loosely related Only shares CSF ID.RA-09: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.PS-06: related, not a mapping …and 1 more in the downloads
CMMC	SC.L2-3.13.2	Security Engineering	Crosswalk	Same topic: Secure Development 9 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 1 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(8)	Risk Analysis; Risk Management…	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping +9 more loosely related (not mappings) §164.312(c) Integrity Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-09: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.316(b) Documentation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.IM-03, ID.RA-09: related, not a mapping …and 5 more in the downloads
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick) 2 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF ID.RA-09: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping
NIS2	6.2	Secure development life cycle	Crosswalk	Same topic: Secure Development 4 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF ID.RA-09: related, not a mapping 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01: related, not a mapping
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.8(2)Art.25(1)Art.26(1)Art.27(1)	Identification; Testing of ICT tools and systems…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +3 more loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF ID.RA-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF ID.RA-09: related, not a mapping
CPS 234	Para 16 Para 17 Para 22 Para 27	Assess third parties' information security capability; Keep capability current as threats and vulnerabilities change…	Loosely related	No mapping. Only shares CSF ID.RA-09, ID.RA-01: related, not a mapping +1 more loosely related (not mappings) Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.