N.6.05 Application Security Testing
Control Overview
This control mandates that organizations involved in software development implement a multi-layered, systematic testing strategy that evaluates security controls with the same rigor as functional user requirements. Applications must not be promoted to production without undergoing comprehensive vulnerability verification. To prevent software vulnerabilities from creating security holes, testing workflows must combine real-time automated pipeline testing, explicit acceptance criteria, and periodic independent external validation (such as penetration testing) scored against standard frameworks like the Common Vulnerability Scoring System (CVSS).
Applicability Note: This control is fully applicable to the anDREa platform and serves as the primary technical validation mechanism proving the safety of the myDRE codebase before it interacts with production resources.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, using a continuous validation lifecycle that separates testing into automated, internal manual, and independent external tiers.
anDREa's multi-layered application testing approach operates across three distinct security verification levels to protect the system's availability and integrity:
- Automated Static Application Security Testing (SAST): In-line build controls via SonarCloud and GitHub Advanced Security Alerts dynamically scan every code commit and package modification for security vulnerabilities and logic flaws. Build pipelines automatically block pull requests that fail preset security quality gates.
- Functional & Acceptance Testing: Software updates are pushed to a ring-fenced Acceptance environment where security configurations, access rules, and encryption layers are validated manually and functionally against our myDRE CIA-AA criteria. To protect operational integrity, tests are planned, scoped, and controlled to ensure zero interference with live customer environments.
- Independent Reviews & Penetration Testing: We supplement our internal code analysis by commissioning periodic, external penetration tests and third-party technical audits. Discovered vulnerabilities are cataloged and prioritized according to their CVSS score, translated into structured Product Backlog Items (PBIs), and managed to closure under the direct oversight of the Information Security Management Board (ISMB) Meetings.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.05.29 - Information security during disruption | Mandates that security testing activities are defined and implemented in the development life cycle and acceptance environments. |
| ISO/IEC 27001 | A.05.35 - Independent review of information security | Requires that the organization's approach to managing information security and its implementation be reviewed independently at planned intervals. |
| ISO/IEC 27001 | A.08.08 - Management of technical vulnerabilities | Governs the technical evaluation, triage, and resolution tracking of flaws identified during testing. |
| Testing Deliverables | Third-Party Penetration Test Reports | Formal, independent audit logs containing vulnerability findings, technical exploits tried, and CVSS impact rankings. (Management Reports) |
| Operational Tracking | GitHub Issue Backlog (PBIs) | Live development tickets showing security flaws converted into actionable items, complete with development logs and closure signatures. |
| Governance Channels | Information Security Management Board (ISMB) Meetings | Routine executive summaries verifying that remediation milestones conform to our established vulnerability SLAs. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Automated deployment pipeline scanning, isolated acceptance testing, independent penetration testing, and structured CVSS-based backlog tracking are completely active and operationalized.
- Continuous Improvement: To enhance transparency during upcoming supervisory audits, maintain a centralized Security Testing Calendar & Coverage Map. This document should explicitly link your automated scanning intervals, scheduled external penetration tests, and technical code audits into a single master ledger to demonstrate proactive, comprehensive test coverage.