FedRAMP High SA-11: Developer Testing and Evaluation

What else in your programme already covers this

This control maps to 38 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 6 controls

CIS-16.1 Establish and Maintain a Secure Application Development Process
CIS-16.12 Implement Code-Level Security Checks
CIS-16.13 Conduct Application Penetration Testing
CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
CIS-16.8 Separate Production and Non-Production Systems
CIS-18.3 Remediate Penetration Test Findings

NIST SP 800-218 · 6 controls

SP800-218-PO.3.3 Toolchain Generates Security Artifacts
SP800-218-PO.4.2 Gather and Safeguard Security Check Information
SP800-218-PW.7.1 Code Review
SP800-218-PW.7.2 Perform Code Review and Analysis
SP800-218-PW.8.1 Executable Testing for Security
SP800-218-PW.8.2 Execute Security Testing

Azure Security Benchmark · 3 controls

ASBv3-DS-4 Integrate static application security testing into DevOps pipeline
ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
DS-6 Enforce security of workload throughout DevOps lifecycle

PCI DSS 4.0 · 3 controls

6.2.3 Custom software reviewed prior to production
6.2.3.1 Code review findings corrected
6.3.1 Security vulnerabilities are identified and managed as follows: • New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs). • Vulnerabilities

AWS Well-Architected Security Pillar · 2 controls

SEC11-BP02 Automate testing throughout the development and release lifecycle
SEC11-BP04 Conduct code reviews

C5 (Germany) · 2 controls

C5-DEV-06 Testing changes
C5-PSS-02 Identification of Vulnerabilities of the Cloud Service

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-AIS-03 Application Security Metrics
CCM-AIS-05 Automated Application Security Testing

ISO 27001:2022 · 2 controls

8.26 Application security requirements
8.29 Security testing in development and acceptance

ISO 27002:2022 · 2 controls

8.25 Secure development life cycle
8.29 Security testing in development and acceptance

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-4 Formal vulnerability management program

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-5 Systems Development and Quality Assurance Category

DORA · 1 control

DORA-Art.25 Testing of ICT tools and systems

ISO 27701:2019 · 1 control

6.11.2 Security in development and support processes

ISO/IEC 42001:2023 · 1 control

A.6.2.4 AI system verification and validation

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

NIST SP 800-161 Rev 1 · 1 control

161R1-SA-11 Developer Testing and Evaluation

NIST SP 800-53 Rev 5 · 1 control

NIST800-SA-11 Developer testing and evaluation

NIST SP 800-53A Rev. 5 · 1 control

53A-2.1 Assessments Within the System Development Life Cycle

SOC 2 · 1 control

SOC2-CC8.1 Change management processes are in place

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of FedRAMP High have you already done?

FedRAMP High SA-11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP High your existing evidence covers. Hold C5 (Germany) and 119 of 410 FedRAMP High controls already carry evidence.

If you hold C5 (Germany)29% covered · 291 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 6 were rejected on the C5 (Germany) pair alone.

See the released pairs, $299 each Browse the graph free