5.3.1—5.3.1

>Control Description

+ The information security requirements associated with the design and development of IT systems are determined and considered. + The information security requirements associated with the acquisition or extension of IT systems and IT components are determined and considered. + Information security requirements associated with changes to developed IT systems are considered. + System approval tests are carried out under consideration of the information security requirements.