[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-11":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-11","SA-11","Developer Testing and Evaluation",93,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Developers of systems, components or services must create and carry out a security and privacy assessment plan, perform testing and evaluation at defined depth and coverage, produce evidence, fix flaws and correct testing processes as needed, at all post-design stages of the life cycle.\n\n**In practice.** For in-house and outsourced development, good practice includes static analysis, dependency scanning, dynamic testing and code review built into the pipeline, with results tracked to remediation. Contracts for third-party development should require the same. Auditors expect test plans, scan outputs, remediation records and gating rules in CI\u002FCD. OWASP SAMM and the NIST SSDF describe similar practices.\n\n**Common gaps.** Testing tools are often deployed but results are not acted on, or findings are suppressed to keep pipelines green. Outsourced developers are rarely held to clear testing requirements.","Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:\n  a. Develop and implement a plan for ongoing security and privacy control assessments;\n  b. Perform [Selection: unit; integration; system; regression] testing\u002Fevaluation [Assignment: organization-defined frequency to conduct] at [Assignment: organization-defined depth and coverage];\n  c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;\n  d. Implement a verifiable flaw remediation process; and\n  e. Correct flaws identified during testing and evaluation.\nDiscussion: Developmental testing and evaluation confirms that the required controls are implemented correctly, operating as intended, enforcing the desired security and privacy policies, and meeting established security and privacy requirements. Security properties of systems and the privacy of individuals may be affected by the interconnection of system components or changes to those components. The interconnections or changes—including upgrading or replacing applications, operating systems, and firmware—may adversely affect previously implemented controls. Ongoing assessment during development allows for additional types of testing and evaluation that developers can conduct to reduce or eliminate potential flaws. Testing custom software applications may require approaches such as manual code review, security architecture review, and penetration testing, as well as and static analysis, dynamic analysis, binary analysis, or a hybrid of the three analysis approaches.\n\nDevelopers can use the analysis approaches, along with security instrumentation and fuzzing, in a variety of tools and in source code reviews. The security and privacy assessment plans include the specific activities that developers plan to carry out, including the types of analyses, testing, evaluation, and reviews of software and firmware components; the degree of rigor to be applied; the frequency of the ongoing testing and evaluation; and the types of artifacts produced during those processes. The depth of testing and evaluation refers to the rigor and level of detail associated with the assessment process. The coverage of testing and evaluation refers to the scope (i.e., number and type) of the artifacts included in the assessment process. Contracts specify the acceptance criteria for security and privacy assessment plans, flaw remediation processes, and the evidence that the plans and processes have been diligently applied. Methods for reviewing and protecting assessment plans, evidence, and documentation are commensurate with the security category or classification level of the system. Contracts may specify protection requirements for documentation.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"governing-open-weight-ai-models-requires-structured-enterprise-risk-frameworks","Governing Open-Weight AI Models Requires Structured Enterprise Risk Frameworks","2026-10-16T18:21:38.63+00:00",{"slug":25,"title":26,"published_at":27},"ics-sniper-xworm-rce-and-ai-introduced-software-flaws-highlight-diverse-attack-surface","ICS-Sniper, XWorm RCE, and AI-Introduced Software Flaws Highlight Diverse Attack Surface","2026-10-16T16:20:31.539+00:00",{"slug":29,"title":30,"published_at":31},"senators-push-for-federal-ai-safety-standards-amid-security-breaches","Senators Push for Federal AI Safety Standards Amid Security Breaches","2026-10-14T16:20:32.423+00:00",{"slug":33,"title":34,"published_at":35},"curl-http2-use-after-free-flaw-enables-client-side-code-execution","curl HTTP\u002F2 Use-After-Free Flaw Enables Client-Side Code Execution","2026-10-14T14:22:24.353+00:00",{"slug":37,"title":38,"published_at":39},"critical-bricksforge-wordpress-plugin-flaw-actively-exploited-patch-immediately","Critical Bricksforge WordPress Plugin Flaw Actively Exploited — Patch Immediately","2026-10-12T14:20:34.292+00:00",{"slug":41,"title":42,"published_at":43},"gobalance-key-exposure-flaw-enables-onion-address-hijacking","GoBalance Key Exposure Flaw Enables .onion Address Hijacking","2026-10-09T10:20:58.801+00:00",{"slug":45,"title":46,"published_at":47},"smart-contract-flaws-let-hacker-drain-53m-from-uranium-finance-twice","Smart Contract Flaws Let Hacker Drain $53M from Uranium Finance Twice","2026-10-08T14:20:40.845+00:00",{"slug":49,"title":50,"published_at":51},"clickfix-lure-drives-lunex-stealer-across-100-ukrainian-sites","ClickFix Lure Drives Lunex Stealer Across 100+ Ukrainian Sites","2026-10-07T10:20:38.802+00:00",{"slug":53,"title":54,"published_at":55},"critical-flaws-in-privileged-access-manager-highlight-pam-security-risks","Critical Flaws in Privileged Access Manager Highlight PAM Security Risks","2026-10-03T12:20:58.495+00:00",{"slug":57,"title":58,"published_at":59},"ai-lowers-the-bar-for-attackers-defenders-must-raise-the-cost-of-exploitation","AI Lowers the Bar for Attackers — Defenders Must Raise the Cost of Exploitation","2026-09-30T12:20:39.857+00:00",{"slug":61,"title":62,"published_at":63},"sql-injection-in-firewall-component-exposes-22-million-swedes-earns-160k-gdpr-fine","SQL Injection in Firewall Component Exposes 2.2 Million Swedes, Earns €160K GDPR Fine","2026-09-30T08:21:23.896+00:00",{"slug":65,"title":66,"published_at":67},"critical-vulnerabilities-in-toptech-tms7-and-tophat-threaten-critical-infrastructure","Critical Vulnerabilities in Toptech TMS7 and TopHAT Threaten Critical Infrastructure","2026-09-29T19:20:55.011+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",45,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",44,{"slug":80,"name":81,"problem":82,"stories":83},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",24,{"slug":85,"name":86,"problem":87,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":89,"name":90,"problem":91,"stories":92},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",12,{"slug":94,"name":95,"problem":96,"stories":97},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",10,[99,105,110,115,120,125,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",62,{"family":100,"item":106,"code":107,"title":108,"together":109},"16","Control 16","Application Software Security",50,{"family":5,"item":111,"code":112,"title":113,"together":114},"si-2","SI-2","Flaw Remediation",48,{"family":116,"item":117,"code":118,"title":118,"together":119},"itil","overview","ITIL",39,{"family":100,"item":121,"code":122,"title":123,"together":124},"2","Control 2","Inventory and Control of Software Assets",36,{"family":126,"item":127,"code":128,"title":129,"together":130},"gdpr","32","Article 32","Security of processing",27,{"family":132,"item":133,"code":134,"title":135,"together":83},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",{"family":137,"item":137,"code":138,"title":139,"together":83},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)"]