Requirement
In addition to the subcontrols in ECC control 1-6-3, cybersecurity requirements related to software and application development projects of the organization's critical systems must include at least the following:
Sub-Controls
1-3-2-1
Requirement: Conducting a security source code review before the critical system release.
1-3-2-2
Requirement: Securing the access, storage, documentation and releases of source code.
1-3-2-3
Requirement: Securing the authenticated Application Programming Interface (API).
1-3-2-4
Requirement: Secure and trusted migration of applications from testing environments to production environments, along with deletion of any data, IDs or passwords related to the testing environment before the migration.
References
- ECC – 2:2024 equivalent: 1-6-3
