The system and application development life cycle shall include security considerations.
Guidance
- System and application development life cycle should include the acquisition process of the
organization's business critical systems and its components.
- Vulnerability awareness and prevention training for (web application) developers, and advanced
social engineering awareness training for high-profile roles should be considered.
- When hosting internet facing applications the implementation of a web application firewall (WAF)
should be considered.

The development process for critical systems and system components shall cover the full
design cycle and shall provide a description of the functional properties of security controls,
and design and implementation information for security-relevant system interfaces.
Guidance
The development cycle includes:
- All development phases: specification , design, development, implementation.
- Configuration management for planned and unplanned changes and change control during the
development.
- Flaw tracking & resolution.
- Security testing.