Review and/or Analysis of Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements, v1.1
Specifies requirements in accordance with NIST Secure Software Development Framework (SSDF), version 1.1, Practice PW.7: Review and/or Analysis of Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements. Requires an organization to help identify vulnerabilities so that they can be corrected before the software is released to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities. Human-readable code includes source code, scripts, and any other form of code that an organization deems human-readable.
Assessment Steps (2)
|
1
Determination of Suitable Code Review Process (DeterminationofSuitableCodeReviewProcess)
Does the organization determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either in a fully automated way or in conjunction with a person) should be used, as defined by the organization?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
|
2
Execution of Suitable Code Review Process (ExecutionofSuitableCodeReviewProcess)
Does the organization perform the code review and/or code analysis based on the its secure coding standards, and record and triage all discovered issues and recommended remediations in the development team's workflow or issue tracking system?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
Conformance Criteria (2)
|
Determination of Suitable Code Review Process
The organization must determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either in a fully automated way or in conjunction with a person) should be used, as defined by the organization.
Citation
SSDF
Task PW.7.1
|
|
Execution of Suitable Code Review Process
The organization must perform the code review and/or code analysis based on the its secure coding standards, and record and triage all discovered issues and recommended remediations in the development team's workflow or issue tracking system.
Citation
SSDF
Task PW.7.2
|