N.6.03 Developing secure applications
Control Overview
This control mandates that organizations engaged in application development formalize, implement, and monitor secure coding best practices throughout the entire software development lifecycle (SDLC). To prevent software bugs, logic flaws, or security vulnerabilities from being introduced into production environments, development teams must apply recognized architectural frameworks and secure coding standards—such as the OWASP Top 10. Security checkpoints must be embedded directly into the engineering workflow through mandatory threat modeling, multi-party code reviews, logical environment separation (DTAP), and automated pipeline security controls.
Applicability Note: This control is fully applicable to the anDREa platform and represents the core defensive framework governing the day-to-day engineering, testing, and deployment of the myDRE ecosystem.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, moving away from "point-in-time" security audits toward an active DevSecOps model.
anDREa’s engineering architecture is governed by a dedicated A.08.25 - Secure development life cycle policy that integrates strict engineering standards natively into the development pipeline. Our strategy guarantees code-level resilience through several parallel enforcement layers:
- Threat Modeling & Secure Design: Before a single line of code is written for major feature sets, technical owners conduct formal threat modeling sessions to proactively identify design flaws.
- OWASP Alignment & Framework Selection: Application development relies strictly on modern, memory-safe frameworks equipped with built-in defenses against classic injection, cross-site scripting (XSS), and authentication exploits, strictly adhering to the OWASP Top 10 baseline (Secure Coding Checklist).
- Strict DTAP Isolation: We enforce complete physical and logical separation between Development, Testing, Acceptance, and Production (DTAP) environments. Real production data or live customer database records are categorically prohibited from being used in non-production testing tiers.
- Continuous In-Line Automated Testing: The platform leverages automated code analysis engines (such as SonarCloud) directly within our CI/CD pipelines to run static application security testing (SAST), blocking pull requests that fail preset security quality gates. This is supported by recurring external, third-party penetration testing.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.08.27 - Secure system architecture and engineering principles | Mandates that principles for secure system engineering are established, documented, applied, and integrated into system development lifecycles. |
| ISO/IEC 27001 | A.08.25 - Secure development life cycle | Establishes rules and checkpoints for managing the full lifecycle of software development from initial requirements to delivery. |
| ISO/IEC 27001 | A.08.29 - Security testing in development and acceptance | Governs the technical validation requirements and acceptance testing criteria for software increments. |
| ISO/IEC 27001 | A.08.31 - Separation of development, test and production environments | Enforces the strict operational separation of development, testing, and live production application stacks. |
| Engineering Governance | Master SDLC Policy Manual | The foundational developer playbook defining architectural guidelines, OWASP compliance patterns, and code review rules. |
| Pipeline Controls | CI/CD SonarCloud Gate Configurations | Real-time automated build definitions proving code-quality metrics, security hot-spot parameters, and blocking logic are functional. (Secure Coding Checklist) |
| Third-Party Validation | Annual Penetration Test Reports | Independent vulnerability audit results verifying the empirical security posture of the live myDRE system. (Management Reports |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Robust environment segregation, automated pipeline security gating, formalized threat modeling, and third-party penetration testing validations are fully active and operationalized.
- Continuous Improvement: To maximize alignment with NIS 2 continuous tracking expectations, ensure that security-relevant insights or edge-case flaws identified during peer code reviews are explicitly captured and linked directly to trackable engineering backlog issues. This demonstrates an active, data-driven security feedback loop to auditors.