Security controls integrated into delivery pipelines provide faster feedback and reduce the cost of fixing vulnerabilities.
Integrate security checks into source control, build, test, artifact, and deployment stages. Define blocking criteria based on application risk and finding severity.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.5-3.1.2 – Application security standards |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 6) Application Security Life Cycle (ASLC) – 6.1 Information security across all application lifecycle stages; 6) Application Security Life Cycle (ASLC) – 6.6 Threat modelling, secure coding, security testing and secure rollout |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(e) – ICT change management: recording, testing, assessing, approving, implementing and verifying changes Article 7 – ICT systems, protocols and tools |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 6.1.1 – All security policies and operational procedures that are identified in Requirement 6 are documented, kept up to date, in use, and known to all affected parties.; 6.2.1 – Bespoke and custom software are developed |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI03 – Managed Solutions Identification and Build > BAI03.07 – Prepare for solution testing. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.17 – SYSTEM AND SERVICES ACQUISITION; SA-15 – DEVELOPMENT PROCESS, STANDARDS, AND TOOLS, Standards, And Tools |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Application Security Life Cycle |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.2 – Control Activities – COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives. CC8.1 – Change Management – The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. |
AICPA
Audit Framework
|
vLatest | View → |