The entity must document and implement a policy for acquiring, developing and maintaining ICT systems that sets security practices and methods, requires technical specifications and security requirements approved by the business function and asset owner, and mitigates unintended alteration or deliberate manipulation during development, maintenance and deployment. A supporting procedure must test and approve all systems before use and after maintenance at a level matching criticality, including quality of in-house software; include static and dynamic source code review and security testing for internet-exposed systems, with an action plan for findings that is monitored; security-test software packages at the latest at integration; keep only anonymised, pseudonymised or randomised production data in non-production environments, except time-limited approved occasions reported to the ICT risk management function; protect source code integrity; and analyse and test proprietary and open-source code and software before production. CCPs and CSDs must involve clearing members, users and linked infrastructures in testing as appropriate. The rules also apply, risk-based, to systems built or run by users outside the ICT function.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.