8.5 Define and apply secure coding guidelines and standards

• 8.5.1 Security weaknesses and vulnerabilities at the source-code level
• 8.5.2 Security of application programming interfaces (API)
• 8.5.3 Secure Coding Practices
• 8.5.4 Software-defined security

8.3 Assess the effectiveness of software security

• 8.3.1 Auditing and logging of changes
• 8.3.2 Risk analysis and mitigation

8.4 Assess security impact of acquired software

• 8.4.1 Commercial-off-the-shelf (COTS)
• 8.4.2 Open Source
• 8.4.3 Third-Party
• 8.4.4 Managed Services (e.g.., enterprise applications)
• 8.4.5 Cloud Services (e.g.., SaaS, IaaS, PaaS)

8.2 Identify & apply security controls in development environments

• 8.2.1 Programming languages
• 8.2.2 Libraries
• 8.2.3 Tool sets
• 8.2.4 Integrated Development Environment (IDE)
• 8.2.5 Runtime
• 8.2.6 Continuous Integration and Continuous Delivery (CI / CD)
• 8.2.7 Software Configuration Management (SCM)
• 8.2.8 Code Repositories
• 8.2.9 Application security testing (e.g., SAST, DAST, IAST & SCA)

8.1 Understand and integrate security in the software development lifecycle

• 8.1.1 Development Methodologies
• 8.1.2 Maturity Models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
• 8.1.3 Operations & Maintenance
• 8.1.4 Change Management
• 8.1.5 Integrated Product Team (IPT)

7.13 Participate in Business Continuity (BC) planning and exercises

7.14 Implement and manage physical security

7.15 Address personnel safety and security concerns

• 7.15.1 Travel
• 7.15.2 Security Training & Awareness
• 7.15.3 Emergency Management
• 7.15.4 Duress

7.12 Test Disaster Recovery Plans

• 7.12.1 Read-through/Checklist
• 7.12.2 Walk-through/Tabletop
• 7.12.3 Simulation
• 7.12.4 Parallel
• 7.12.5 Full Interruption
• 7.12.6 Communications (e.g., stakeholders, test status, regulators)

7.11 Implement Disaster Recovery Process

• 7.11.1 Response
• 7.11.2 Personnel
• 7.11.3 Communications
• 7.11.4 Assessment
• 7.11.5 Restoration
• 7.11.6 Training & Awareness
• 7.11.7 Lessons Learned

7.8 Implement and support patch and vulnerability management

7.9 Understand and participate in change management processes

7.10 Implement recovery strategies

• 7.10.1 Backup storage strategies
• 7.10.2 Recovery site strategies
• 7.10.3 Multiple processing sites
• 7.10.4 System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance (FT)

7.7 Operate and maintain detection and preventative measures

• 7.7.1 Firewall
• 7.7.2 Intrusion detection and prevention systems
• 7.7.3 Whitelisting/Blacklisting
• 7.7.4 Third-party provided security services
• 7.7.5 Sandboxing
• 7.7.6 Honeypots / Honeynets
• 7.7.7 Anti-malware
• 7.7.8 Machine learning and artificial intelligence (AI) based tools

7.6 Conduct incident management

• 7.6.1 Detection
• 7.6.2 Response
• 7.6.3 Mitigation
• 7.6.4 Reporting
• 7.6.5 Recovery
• 7.6.6 Remediation
• 7.6.7 Lessons Learned