CFTC System Safeguards (17 CFR 37, 38, 39, 49)
CFTC System Safeguards: Risk Analysis and Oversight Program

CFTC System Safeguards (17 CFR 37, 38, 39, 49) CFTC-SS-5: Systems Development and Quality Assurance Category

Address systems development and quality assurance within the program, covering requirements development, pre production and regression testing, change management procedures and approvals, outsourcing and vendor management, and training in secure coding practices.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 82 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 8 controls

  • 5.8 Information security in project management
  • 8.25 Secure development life cycle
  • 8.26 Application security requirements
  • 8.28 Secure coding
  • 8.29 Security testing in development and acceptance
  • 8.30 Outsourced development
  • 8.31 Separation of development, test and production environments
  • 8.32 Change management

ISO 27002:2022 · 8 controls

  • 5.8 Information security in project management
  • 8.25 Secure development life cycle
  • 8.26 Application security requirements
  • 8.28 Secure coding
  • 8.29 Security testing in development and acceptance
  • 8.30 Outsourced development
  • 8.31 Separation of development, test and production environments
  • 8.32 Change management

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 7 controls

FedRAMP High · 6 controls

  • AT-3 Role-Based Training
  • CM-3(2) Testing, Validation, and Documentation of Changes
  • SA-11 Developer Testing and Evaluation
  • SA-15 Development Process, Standards, and Tools (SA-15)
  • SA-3 System Development Life Cycle
  • SA-9 External System Services

FedRAMP Moderate · 6 controls

  • AT-3 Role-Based Training
  • CM-3(2) Testing, Validation, and Documentation of Changes
  • SA-11 Developer Testing and Evaluation
  • SA-15 Development Process, Standards, and Tools (SA-15)
  • SA-3 System Development Life Cycle
  • SA-9 External System Services

CIS Controls v8 · 5 controls

  • CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training
  • CIS-15.2 Establish and Maintain a Service Provider Management Policy
  • CIS-16.1 Establish and Maintain a Secure Application Development Process
  • CIS-16.8 Separate Production and Non-Production Systems
  • CIS-16.9 Train Developers in Application Security Concepts and Secure Coding

NIST SP 800-171 Rev 3 · 5 controls

NIST SP 800-53 Rev 5 · 5 controls

PCI DSS 4.0 · 5 controls

  • 6.2.1 6.2.1 Secure development of bespoke and custom software
  • 6.2.2 6.2.2 Annual secure software training for developers
  • 6.2.3 6.2.3 Code review before release
  • 6.5.1 6.5.1 Change control procedure for production
  • 6.5.3 6.5.3 Separate pre-production from production

Azure Security Benchmark · 4 controls

  • ASBv3-DS-4 Integrate static application security testing into DevOps pipeline
  • ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
  • ASBv3-GS-10 Define and implement DevOps security strategy
  • DS-6 Enforce security of workload throughout DevOps lifecycle

C5 (Germany) · 4 controls

  • C5-DEV-01 Policies for the development/procurement of information systems
  • C5-DEV-02 Outsourcing of the development
  • C5-DEV-04 Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools
  • C5-DEV-06 Testing changes

NIST SP 800-161 Rev 1 · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-37 Service Provider Management Policy
  • CPS230-43 Due Diligence Before Entering or Modifying a Material Arrangement
  • CPS230-P48 Required Content of the Service Provider Management Policy

CMMC 2.0 · 3 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
  • NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

SOC 2 · 3 controls

  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
  • SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk

DORA · 1 control

HIPAA Security Rule · 1 control

  • 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

NIST SP 800-66 Rev 2 · 1 control

  • 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CFTC System Safeguards: Risk Analysis and Oversight Program

You are reading one control. How much of CFTC System Safeguards (17 CFR 37, 38, 39, 49) have you already done?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) CFTC-SS-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CFTC System Safeguards (17 CFR 37, 38, 39, 49) your existing evidence covers. Hold NIST Cybersecurity Framework 2.0 and 28 of 39 CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls already carry evidence.

If you hold NIST Cybersecurity Framework 2.071.8% covered · 11 gapsIf you hold FedRAMP Moderate69.2% covered · 12 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.161.5% covered · 15 gapsIf you hold C5 (Germany)59% covered · 16 gapsIf you hold DORA51.3% covered · 19 gapsIf you hold NIST SP 800-161 Rev 148.7% covered · 20 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 5 were rejected on the NIST Cybersecurity Framework 2.0 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 82 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls