Design of Software to Meet Security Requirements and Mitigate Security Risks, v1.1

Specifies requirements in accordance with NIST Secure Software Development Framework (SSDF), version 1.1, Practice PW.1: Design of Software to Meet Security Requirements and Mitigate Security Risks. Requires an organization to identify and evaluate the security requirements for the software; determine what security risks the software is likely to face during operation and how the software's design and architecture should mitigate those risks; and justify any cases where risk-based analysis indicates that security requirements should be relaxed or waived. Addressing security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.

Assessment Steps (3)

1
Use of Risk Modeling for Software (UseofRiskModelingforSoftware)
Does the organization use forms of risk modeling - such as threat modeling, attack modeling, or attack surface mapping - to help assess the security risk for the software?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
2
Maintenance and Tracking of Software Security Info (MaintenanceandTrackingofSoftwareSecurityInfo)
Does the organization track and maintain the software's security requirements, risks, and design decisions?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
3
Use of Standardized Security Features and Services (UseofStandardizedSecurityFeaturesandServices)
Does the organization, where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log management, identity management, access control, and vulnerability management systems) instead of creating proprietary implementations of security features and services?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.

Conformance Criteria (3)

Use of Risk Modeling for Software
The organization must use forms of risk modeling - such as threat modeling, attack modeling, or attack surface mapping - to help assess the security risk for the software.
Citation
SSDF
Task PW.1.1
Maintenance and Tracking of Software Security Info
The organization must track and maintain the software's security requirements, risks, and design decisions.
Citation
SSDF
Task PW.1.2
Use of Standardized Security Features and Services
The organization must, where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log management, identity management, access control, and vulnerability management systems) instead of creating proprietary implementations of security features and services.
Citation
SSDF
Task PW.1.3