Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

frameworkNIST Cybersecurity Framework 2.0 sectionProtect (PR) topicsSecure Development, Web Security, API Security frameworks6 2 5

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of PR.PS-06 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.8.5 A.8.25 A.8.26 A.8.28 A.8.29	Secure authentication; Secure development life cycle…	Crosswalk	Same topic: API Security, Secure Development, Web Security 1 loosely related (not mappings) A.8.31 Separation of development, test and production environments Loosely related Only shares CSF PR.PS-06: related, not a mapping
CIS v8.1	CIS 16.1 CIS 9.3 CIS 13.10 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.10 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Maintain and Enforce Network-Based URL Filters…	Crosswalk	Same topic: Secure Development, Web Security, API Security
SOC 2	CC6.6 CC8.1	Protection against threats from outside system boundaries; Change management for infrastructure, data and software	Editorial	Same topic: Web Security, Secure Development (editorial pick)
PCI DSS	6.2.2 6.2.3 6.2.1 6.2.4 6.4.1 6.4.3	Developers trained in secure software development; Custom code reviewed before release…	Crosswalk	Same topic: Secure Development, API Security, Web Security 2 loosely related (not mappings) 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF PR.PS-06: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF PR.PS-06: related, not a mapping
CMMC	SC.L2-3.13.1 SC.L2-3.13.2	Boundary Protection; Security Engineering	Crosswalk	Same topic: Web Security, Secure Development
800-53	IA-9 SA-3 SA-8 SA-11 SA-15 SC-5 SC-7 SI-10	Service Identification and Authentication; System Development Life Cycle…	Crosswalk	Same topic: API Security, Secure Development, Web Security 3 loosely related (not mappings) SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-06: related, not a mapping SA-17 Developer Security and Privacy Architecture and Design Loosely related Only shares CSF PR.PS-06: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF PR.PS-06: related, not a mapping
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick)
NIS2	6.2	Secure development life cycle	Crosswalk	Same topic: Secure Development
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.