RV.3.2—Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.
RV.3
>Control Description
Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.
>Practice: RV.3
Analyze Vulnerabilities to Identify Their Root Causes
Help reduce the frequency of vulnerabilities in the future.
>Notional Implementation Examples
- 1.Record lessons learned through root cause analysis in a wiki that developers can access and search.
- 2.Add mechanisms to the toolchain to automatically detect future instances of the root cause.
- 3.Update manual processes to detect future instances of the root cause.
>Cross-Framework References
Mappings to related frameworks and standards from NIST SP 800-218
BSA FSS
VM.2-1
PD.1-3
BSIMM
CP3.3
CMVM3.2
EO 14028
4e(ix)
IEC 62443
DM-4
ISO 30111
7.1.7
OWASP SAMM
IM3-B
PCI SSLC
2.6
4.2
SAFECode FPSSD
Secure Development Lifecycle Feedback
SP 800-160
3.3.8
SP 800-181 (NICE)
T0111
K0009
K0039
K0070
K0343
Ask AI
Configure your API key to use AI features.