AWS Well-Architected Security Pillar SEC11-BP02: Automate testing throughout the development and release lifecycle

What else in your programme already covers this

This control maps to 65 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-AIS-04 Secure Application Design and Development
CCM-AIS-05 Automated Application Security Testing
CCM-AIS-07 Application Vulnerability Remediation
CCM-CCC-02 Quality Testing
CCM-TVM-05 External Library Vulnerabilities

FedRAMP High · 5 controls

CM-3(2) Testing, Validation, and Documentation of Changes
IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))
SA-11 Developer Testing and Evaluation
SA-11(1) Developer Testing and Evaluation | Static Code Analysis (SA-11(1))
SI-10 Information Input Validation

FedRAMP Moderate · 5 controls

CM-3(2) Testing, Validation, and Documentation of Changes
IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))
SA-11 Developer Testing and Evaluation
SA-11(1) Developer Testing and Evaluation | Static Code Analysis (SA-11(1))
SI-10 Information Input Validation

NIST SP 800-171 Rev 3 · 5 controls

03.04.03 Configuration Change Control
03.04.04 Impact Analyses
03.11.02 Vulnerability Monitoring and Scanning
03.14.01 Flaw Remediation
03.16.01 Security Engineering Principles

NIST SP 800-218 · 5 controls

SP800-218-PO.1.2 Implement Security Requirements in the Toolchain
SP800-218-PO.4.1 Criteria for Software Security
SP800-218-PW.4.4 Verify Acquired Components Meet Security Requirements
SP800-218-PW.7.1 Code Review
SP800-218-PW.8.1 Executable Testing for Security

PCI DSS 4.0 · 5 controls

11.3.1.3 11.3.1.3 Internal scans after significant change
6.2.1 6.2.1 Secure development of bespoke and custom software
6.2.3 6.2.3 Code review before release
6.2.4 6.2.4 Engineering techniques against common software attacks
6.4.1 6.4.1 Public web application review or automated protection

Azure Security Benchmark · 4 controls

ASBv3-DS-4 Integrate static application security testing into DevOps pipeline
ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
DS-2 Ensure software supply chain security
DS-6 Enforce security of workload throughout DevOps lifecycle

C5 (Germany) · 4 controls

C5-DEV-01 Policies for the development/procurement of information systems
C5-DEV-06 Testing changes
C5-OPS-22 Testing and Documentation of known Vulnerabilities
C5-PSS-02 Identification of Vulnerabilities of the Cloud Service

CMMC 2.0 · 4 controls

CM.L2-3.4.4 Security Impact Analysis
RA.L2-3.11.2 Vulnerability Scan
SC.L2-3.13.2 Security Engineering
SI.L2-3.14.5 System & File Scanning

ISO 27001:2022 · 4 controls

8.25 Secure development life cycle
8.28 Secure coding
8.29 Security testing in development and acceptance
8.8 Management of technical vulnerabilities

NIST SP 800-161 Rev 1 · 4 controls

161R1-CM-4 Impact Analysis
161R1-RA-5 Vulnerability Monitoring and Scanning
161R1-SA-11 Developer Testing and Evaluation
161R1-SA-3 System Development Life Cycle

NIST SP 800-53 Rev 5 · 4 controls

NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning
NIST800-SA-11 SA-11 Developer Testing and Evaluation
NIST800-SA-3 SA-3 System Development Life Cycle
NIST800-SI-2 SI-2 Flaw Remediation

CIS Controls v8 · 3 controls

CIS-16.1 Establish and Maintain a Secure Application Development Process
CIS-16.12 Implement Code-Level Security Checks
CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components

ISO 27002:2022 · 3 controls

8.25 Secure development life cycle
8.29 Security testing in development and acceptance
8.8 Management of technical vulnerabilities

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

ISO 27701:2019 · 1 control

6.11.2 Security in development and support processes

ISO/IEC 42001:2023 · 1 control

A.6.2.4 AI system verification and validation

SOC 2 · 1 control

SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of AWS Well-Architected Security Pillar have you already done?

AWS Well-Architected Security Pillar SEC11-BP02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of AWS Well-Architected Security Pillar your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 52 of 63 AWS Well-Architected Security Pillar controls already carry evidence.

If you hold NIST SP 800-53 Rev 582.5% covered · 11 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.6% covered · 16 gaps If you hold ISO 27002:202273% covered · 17 gaps If you hold FedRAMP Moderate69.8% covered · 19 gaps If you hold Azure Security Benchmark65.1% covered · 22 gaps If you hold PCI DSS 4.063.5% covered · 23 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free