Objective: Information security is an integral part of the entire lifecycle of IT systems. This particularly includes consideration of information security requirements in the development or acquisition of IT systems.
Requirements (must): The information security requirements associated with the design and development of IT systems are determined and considered.
The information security requirements associated with the acquisition or extension of IT systems and IT components are determined and considered.
Information security requirements associated with changes to developed IT systems are considered.
System approval tests are carried out under consideration of the information security requirements.
Requirements (should): Requirement specifications are prepared. The following aspects are considered:
- The information security requirements.
- Vendor recommendations and best practices for secure configuration and implementation
- Best practices and security guidelines
- Fail safe (designed to return to a safe condition in the event of a failure or malfunction)
Requirement specifications are reviewed against the information security requirements.
The IT system is reviewed for compliance with specifications prior to productive use.
The use of productive data for testing purposes is avoided as far as possible (if applicable, anonymization or pseudonymization):
- Where productive data are used for testing purposes, it shall be ensured that the test system is provided with protective measures comparable to those on the operational system,
- Requirements for the lifecycle of test data (e.g. deletion, maximum lifetime on the IT system),
- Case-related specifications for the generation of test data are defined.
Whenever new data systems are acquired, a pre-defined procurement process and rules are followed. The rules ensure that the supplier is able to guarantee an adequate level of security, taking into account the priority of the system.
The data and other materials used for testing should be carefully selected and protected.
Production information that contains personal or other confidential information should not be used for testing purposes.
Inadequate change management is a common cause of incidents for digital services.
An organization shall document the change management process that must be followed whenever significant changes are made to developed digital services or other computing services that affect cyber security. The process includes requirements e.g. for the following:
Whenever new data systems are acquired or developed, pre-defined security rules are followed, taking into account the priority of the system. The rules ensure that adequate measures are taken to ensure the security of the data and data processing in the system.
Organization ensures that the following aspects are covered in the requirement specifications for new system development:
Newly developed systems are reviewed against the specifications before moving to production use.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
