[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-15":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-15","SA-15","Development Process, Standards, and Tools",36,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Developers must follow a documented development process that addresses security and privacy, identifies the standards and tools used, documents tool options and configurations and maintains the integrity of changes, and the organisation must review that process periodically.\n\n**In practice.** This means a secure development life cycle with defined coding standards, approved tools, pipeline configuration under change control and security activities at each phase. Auditors expect the documented process, evidence it is followed in real projects and periodic reviews of its effectiveness. The NIST Secure Software Development Framework and OWASP SAMM describe comparable practices.\n\n**Common gaps.** Organisations frequently document a process that does not match how teams actually work. Tooling and pipeline configurations change without review, weakening the integrity of builds.","a. Require the developer of the system, system component, or system service to follow a documented development process that:\n    1. Explicitly addresses security and privacy requirements;\n    2. Identifies the standards and tools used in the development process;\n    3. Documents the specific tool options and tool configurations used in the development process; and\n    4. Documents, manages, and ensures the integrity of changes to the process and\u002For tools used in development; and\n  b. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined organization-defined security and privacy requirements].\nDiscussion: Development tools include programming languages and computer-aided design systems. Reviews of development processes include the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes facilitates effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ai-powered-zero-days-543k-exposed-secrets-and-blockchain-malware-highlight-systemic-security-gaps","AI-Powered Zero-Days, 543K Exposed Secrets, and Blockchain Malware Highlight Systemic Security Gaps","2026-10-01T19:20:23.28+00:00",{"slug":25,"title":26,"published_at":27},"500000-active-credentials-exposed-in-public-github-repos","500,000 Active Credentials Exposed in Public GitHub Repos","2026-10-01T10:20:32.463+00:00",{"slug":29,"title":30,"published_at":31},"543000-valid-credentials-exposed-in-public-github-repos-for-over-2-years","543,000+ Valid Credentials Exposed in Public GitHub Repos for Over 2 Years","2026-09-30T20:21:00.802+00:00",{"slug":33,"title":34,"published_at":35},"ai-driven-security-research-targets-vulnerabilities-in-military-messaging-apps","AI-Driven Security Research Targets Vulnerabilities in Military Messaging Apps","2026-09-29T18:20:21.659+00:00",{"slug":37,"title":38,"published_at":39},"mcp-python-sdk-oauth-credential-theft-via-malicious-server-redirect","MCP Python SDK OAuth Credential Theft via Malicious Server Redirect","2026-09-29T08:21:06.466+00:00",{"slug":41,"title":42,"published_at":43},"nextjs-jsx-to-svg-injection-flaw-demands-immediate-upgrade","Next.js JSX-to-SVG Injection Flaw Demands Immediate Upgrade","2026-09-23T20:20:55.033+00:00",{"slug":45,"title":46,"published_at":47},"hard-coded-credentials-and-cleartext-transmission-expose-eld-telemetry-data","Hard-Coded Credentials and Cleartext Transmission Expose ELD Telemetry Data","2026-09-17T18:23:21.435+00:00",{"slug":49,"title":50,"published_at":51},"ai-powered-recon-hardcoded-secrets-in-android-apks-exploited-at-scale","AI-Powered Recon: Hardcoded Secrets in Android APKs Exploited at Scale","2026-09-11T22:20:21.475+00:00",{"slug":53,"title":54,"published_at":55},"ai-safety-concerns-prompt-researcher-resignation-at-anthropic","AI Safety Concerns Prompt Researcher Resignation at Anthropic","2026-09-10T16:21:49.445+00:00",{"slug":57,"title":58,"published_at":59},"exposed-admin-keys-in-public-javascript-led-to-88m-record-breach-at-manchester-airports","Exposed Admin Keys in Public JavaScript Led to 8.8M Record Breach at Manchester Airports","2026-09-03T16:20:24.88+00:00",{"slug":61,"title":62,"published_at":63},"ai-coding-environments-need-embedded-security-scanning","AI Coding Environments Need Embedded Security Scanning","2026-09-02T18:21:23.906+00:00",{"slug":65,"title":66,"published_at":67},"encryption-key-exposed-in-api-leads-to-startup-platform-data-breach","Encryption Key Exposed in API Leads to Startup Platform Data Breach","2026-08-24T16:21:17.656+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",15,{"slug":75,"name":76,"problem":77,"stories":78},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",14,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",12,{"slug":85,"name":86,"problem":87,"stories":88},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",9,{"slug":90,"name":91,"problem":92,"stories":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",8,{"slug":95,"name":96,"problem":97,"stories":98},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,[100,106,110,116,120,124,128,134],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","16","Control 16","Application Software Security",18,{"family":101,"item":107,"code":108,"title":109,"together":73},"7","Control 7","Continuous Vulnerability Management",{"family":111,"item":112,"code":113,"title":114,"together":115},"gdpr","32","Article 32","Security of processing",13,{"family":101,"item":117,"code":118,"title":119,"together":115},"2","Control 2","Inventory and Control of Software Assets",{"family":121,"item":121,"code":122,"title":123,"together":83},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",{"family":101,"item":125,"code":126,"title":127,"together":83},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":129,"item":130,"code":131,"title":132,"together":133},"nist-sp","800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",11,{"family":135,"item":136,"code":137,"title":137,"together":88},"itil","overview","ITIL"]