IT System Acquisition & Development

This standard applies to all application development within an organization but is supplemented by a separate standard for the development of web applications security standard.

This standard is not intended to be an exhaustive list of security considerations for development – many sources of good practice are available such as Carnegie Mellon University Software Engineering Institute (SEI) Capability Maturity Model, Agile, and other traditional Waterfall Models. [Company Name] software development teams must seek appropriate guidance, especially when using new application languages, tools, and frameworks.

Maintaining a strong information security posture and managing information security risks relies on many disparate controls within infrastructure, operating environments, and applications. The threats facing the Company are changing and security attacks are focused on security vulnerabilities in software applications as opposed to infrastructure devices, hence there is an increased focus on the development of applications.

The purpose of this standard sets out the baseline requirements for information security within the “System Acquisition and Development” lifecycle, in order to reduce the risk of vulnerabilities being introduced by applications acquired or developed internally by a Company.

The methods that the Company can adopt to implement information systems are as follows:

Nowadays, with the digitalization of our society, the need for data protection became more important. The latest IT Security Standards involve the application of technology to broader social and institutional contexts, and thereby contributes to the servitization of companies, and affects how they compete and interact. This document contains security technology solutions to protect data classified as “Highly Sensitive”, “Sensitive”, “Private” or “Public” as per the Data Classification Standard and Data Handling Guidelines. Specifically: