The FI should establish an SDLC framework defining processes, procedures and controls for each phase (initiation or planning, requirements, design, implementation, testing, acceptance), whatever the model (Waterfall or Agile), and maintain standards for each phase. Security-by-design builds security into every phase: security specifications in design, continuous security evaluation and secure practices throughout. Security requirements should cover at least access control, authentication, authorisation, data integrity and confidentiality, system activity logging, security event tracking and exception handling, and the IT security function should be involved in each phase where relevant.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.