Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-AIS-01: Application and Interface Security Policy and Procedures

What else in your programme already covers this

This control maps to 31 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-218 · 5 controls

SP800-218-PO.1.1 Define Security Requirements for Software Development
SP800-218-PO.2.1 Roles and Responsibilities for Secure Development
SP800-218-PO.2.3 Obtain Management Commitment to Secure Development
SP800-218-PW.5.1 Secure Coding Practices
SP800-218-RV.3.3 Review SDLC to Prevent Recurrence

FedRAMP High · 3 controls

SA-15 Development Process, Standards, and Tools (SA-15)
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles

FedRAMP Moderate · 3 controls

SA-15 Development Process, Standards, and Tools (SA-15)
SA-3 System Development Life Cycle
SA-8 Security and Privacy Engineering Principles

NIST SP 800-53 Rev 5 · 3 controls

NIST800-SA-1 SA-1 Policy and Procedures
NIST800-SA-15 SA-15 Development Process, Standards, and Tools
NIST800-SA-3 SA-3 System Development Life Cycle

C5 (Germany) · 2 controls

C5-DEV-01 Policies for the development/procurement of information systems
C5-DEV-04 Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools

ISO 27001:2022 · 2 controls

8.25 Secure development life cycle
8.26 Application security requirements

ISO 27002:2022 · 2 controls

8.25 Secure development life cycle
8.26 Application security requirements

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

NIST SP 800-161 Rev 1 · 2 controls

161R1-SA-1 Policy and Procedures
161R1-SA-15 Development Process, Standards, and Tools

PCI DSS 4.0 · 2 controls

6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
6.2.1 6.2.1 Secure development of bespoke and custom software

AWS Well-Architected Security Pillar · 1 control

SEC11-BP01 Train for application security

Azure Security Benchmark · 1 control

ASBv3-GS-10 Define and implement DevOps security strategy

CIS Controls v8 · 1 control

CIS-16.1 Establish and Maintain a Secure Application Development Process

CNCF Security Technical Advisory Group (TAG) · 1 control

CNCF-DEV-CHECKS Security Checks in Development

EU AI Act · 1 control

EUAI-Art.17 Quality management system

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-AIS-01 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free