N.6.04 Information security awareness in application development
Control Overview
This control mandates that organizations involved in developing applications establish and maintain targeted information security awareness, education, and technical training programs for their engineering and development personnel. General corporate awareness is insufficient for technical roles; developers must deeply understand the specific security risks associated with software design, secure coding practices, cryptographic implementation, API management, and dependency vulnerabilities. The goal is to proactively prevent software flaws or logical errors from being introduced into production environments by fostering a resilient engineering culture.
Applicability Note: This control is fully applicable to the anDREa platform and directly shapes the security training, code review patterns, and continuous learning path of our core development team.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, translating general awareness obligations into role-specific, technical education tracks.
At anDREa, developer training goes beyond standard annual slide decks. We combine structured technical training with automated feedback loops to keep security embedded in the day-to-day coding workflow:
- Role-Specific Onboarding & Training: Engineering personnel receive specialized instruction upon onboarding and through regular training cycles. This covers secure application architectures, the OWASP Top 10 vulnerabilities, safe secrets management (preventing hardcoded API keys), and the strict handling of platform configurations (Secure Coding Checklist) based on our mydre CIA-AA Classification requirements.
- Continuous DevSecOps Feedback Loops: Rather than isolating training within classroom environments, we treat our automated toolings—such as SonarCloud security alerts and GitHub Dependabot warnings—as real-time learning instruments. Flagged alerts provide inline educational context, showing developers exactly why a particular code snippet or library poses a threat and how to remediate it.
- Governance Reinforcement: Security engineering priorities are consistently updated through discussions at the Information Security Management Board (ISMB) Meetings, insights derived from internal technical audits, and post-penetration test debriefs, ensuring real-world attack trends feed directly back into our engineering practices.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.06.03 - Information security awareness, education and training | Mandates that personnel receive appropriate screening, education, training, and regular updates on organizational policies and procedures. |
| ISO/IEC 27001 | A.08.25 - Secure development life cycle | Sets operational rules for ensuring developers possess the technical competencies required to write secure software. |
| ISO/IEC 27001 | A.08.29 - Security testing in development and acceptance | Governs peer code review gates and acceptance criteria, reinforcing developer security awareness through mutual oversight. |
| Training Records | Technical Security Training Logs | Documented proof of completed secure coding tutorials, OWASP module completions, and internal engineering workshops. |
| Governance Channels | Information Security Management Board (ISMB) Meetings | Official management registers tracking how penetration test findings and technical vulnerabilities are analyzed and translated into future developer training priorities. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Role-specific engineering training, inline DevSecOps tooling guidance, continuous peer review enforcement, and structured ISMB oversight loops are completely active and auditable.