保护 (PR) · 主题
安全开发
将安全融入 SDLC。
安全开发由 NIST CSF 2.0 成果 PR.PS-06 (Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle) 定义。 对照映射 通过 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2 和 GDPR 中经编辑映射。 本站数据中无映射 本站数据中 HIPAA, Essential Eight, DORA, CPS 234 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | 主题定义 | PR.PS-06 |
| ISO 27001 | A.8.25A.8.26A.8.28A.8.29 | Secure development life cycle; Application security requirements; Secure coding… | 对照映射 | A.8.25: via PR.PS-06; NIST 800-53 map: SA-3, SA-15 A.8.26: via PR.PS-06 A.8.28: via PR.PS-06; NIST 800-53 map: SA-8, SA-11, SA-15 A.8.29: via PR.PS-06; NIST 800-53 map: SA-11 |
| CIS v8.1 | CIS 16.1CIS 16.2CIS 16.12CIS 16.3CIS 16.5CIS 16.8CIS 16.9CIS 16.11CIS 16.13CIS 16.14 | Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities; Implement Code-Level Security Checks… | 对照映射 | CIS 16.1: via PR.PS-06 CIS 16.2: A process to accept and address reports of software vulnerabilities, part of a secure development lifecycle. CIS 16.12: Code-level security checks (static and dynamic analysis) during development. CIS 16.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): root cause analysis of vulnerabilities. CIS 16.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): up-to-date, trusted third-party components. CIS 16.8: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): separate production and non-production systems. CIS 16.9: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): developer secure-coding training. CIS 16.11: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): vetted modules for security components. CIS 16.13: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): application penetration testing. CIS 16.14: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): threat modelling. |
| SOC 2 | CC8.1 | Change management for infrastructure, data and software | 编辑说明 | CC8.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.2.16.2.26.2.3 | Bespoke and custom software developed securely; Developers trained in secure software development; Custom code reviewed before release | 对照映射 | 6.2.1: Bespoke and custom software developed securely; omitted from NIST's PCI references for PR.PS-06. 6.2.2: via PR.PS-06 6.2.3: via PR.PS-06 |
| CMMC | SC.L2-3.13.2 | Security Engineering | 对照映射 | SC.L2-3.13.2: via 800-171r2 Appendix D → SA-8 |
| 800-53 | SA-3SA-8SA-11SA-15 | System Development Life Cycle; Security and Privacy Engineering Principles; Developer Testing and Evaluation… | 对照映射 | SA-3: via PR.PS-06 SA-8: via PR.PS-06 SA-11: via PR.PS-06 SA-15: via PR.PS-06 |
| HIPAA | — | 无要求 | 本站数据中无映射 | 本站数据中没有 HIPAA 要求映射到此主题。 |
| GDPR | Art.25(1) | Data protection by design and by default | 编辑说明 | Art.25(1): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 6.2 | Secure development life cycle | 对照映射 | 6.2: via PR.PS-06; ENISA ISO map: A.8.25 |
| Essential Eight | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Essential Eight 要求映射到此主题。 |
| DORA | — | 无要求 | 本站数据中无映射 | 本站数据中没有 DORA 要求映射到此主题。 |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于安全开发
安全开发实践将安全措施嵌入软件开发生命周期（SDLC）的各个阶段，以便在代码进入生产环境之前识别并修复漏洞。具体包括设计阶段的威胁建模、安全编码标准、静态应用安全测试（SAST）、动态应用安全测试（DAST）、针对第三方依赖项的软件成分分析（SCA），以及代码审查流程。将安全左移可以降低修复成本，并防止注入缺陷、身份验证失效和不安全反序列化等常见漏洞进入生产环境。