PW.1.2—Track and maintain the software’s security requirements, risks, and design decisions.
PW.1
>Control Description
Track and maintain the software’s security requirements, risks, and design decisions.
>Practice: PW.1
Design Software to Meet Security Requirements and Mitigate Security Risks
Identify and evaluate the security requirements for the software; determine what security risks the software is likely to face during operation and how the software’s design and architecture should mitigate those risks; and justify any cases where risk-based analysis indicates that security requirements should be relaxed or waived. Addressing security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.
>Notional Implementation Examples
- 1.Record the response to each risk, including how mitigations are to be achieved and what the rationales are for any approved exceptions to the security requirements. Add any mitigations to the software’s security requirements.
- 2.Maintain records of design decisions, risk responses, and approved exceptions that can be used for auditing and maintenance purposes throughout the rest of the software life cycle.
- 3.Periodically re-evaluate all approved exceptions to the security requirements, and implement changes as needed.
>Cross-Framework References
Mappings to related frameworks and standards from NIST SP 800-218
Ask AI
Configure your API key to use AI features.