CyberStrikeus/CyberStrike - Page 114

sp-800-171-03-13-05-031305

03.13.05

sp-800-171-03-13-07-031307

03.13.07

sp-800-171-03-13-14-031314

03.13.14

sp-800-171-03-13-16-031316

03.13.16

flaw-remediation-03-14-01-flaw-remediation

Identify, report, and correct system flaws.

malicious-code-protection-03-14-02-malicious-code-protection

Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.

sp-800-171-03-14-04-031404

03.14.04

sp-800-171-03-14-05-031405

03.14.05

sp-800-171-03-14-07-031407

03.14.07

system-monitoring-03-14-06-system-monitoring

Monitor the system to detect: Attacks and indicators of potential attacks and Unauthorized connections. Identify unauthorized use of the system. Monit

policy-and-procedures-03-15-01-policy-and-procedures

Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for...

rules-of-behavior-03-15-03-rules-of-behavior

Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI.

system-security-plan-03-15-02-system-security-plan

Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by

external-system-services-03-16-03-external-system-services

Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security re...

po-1-1-po11

Identify and document all security requirements for the organization’s software development infrastructures and processes, and maintain the requiremen

po-1-2-po12

Identify and document all security requirements for organization-developed software to meet, and maintain the requirements over time.

po-1-3-po13

Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s o...

po-2-1-po21

Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC.

po-2-2-po22

Provide role-based training for all personnel with responsibilities that contribute to secure development.

po-2-3-po23

Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development-related roles and

po-3-1-po31

Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components a

po-3-2-po32

Follow recommended security practices to deploy, operate, and maintain tools and toolchains.

po-3-3-po33

Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.

po-4-1-po41

Define criteria for software security checks and track throughout the SDLC.

po-4-2-po42

Implement processes, mechanisms, etc.

po-5-1-po51

Separate and protect each environment involved in software development.

po-5-2-po52

Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related t

ps-1-1-ps11

Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that onl...

ps-2-1-ps21

Make software integrity verification information available to software acquirers.

ps-3-1-ps31

Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software

ps-3-2-ps32

Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials .SBOM).

pw-1-1-pw11

Use forms of risk modeling – such as threat modeling, attack modeling, or attack surface mapping – to help assess the security risk for the software.

pw-1-2-pw12

Track and maintain the software’s security requirements, risks, and design decisions.

pw-1-3-pw13

Where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log m...

pw-2-1-pw21

Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the so

pw-4-1-pw41

Acquire and maintain well-secured software components (e.g., software libraries, modules, middleware, frameworks) from commercial, open-source, and ot

pw-4-2-pw42

Create and maintain well-secured software components in-house following SDLC processes to meet common internal software development needs that cannot

pw-4-4-pw44

Verify that acquired commercial, open-source, and all other third-party software components comply with the requirements, as defined by the organizati

pw-5-1-pw51

Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization’s requirements.

pw-6-1-pw61

Use compiler, interpreter, and build tools that offer features to improve executable security.