Scope Enterprise Active

Application Security

To ensure the security of internally developed and acquired applications.

Domain ID
DOM-015
Domain Code
APP
Business Owner
Application Security

Domain Overview

APP · Full Domain Profile
Short Overview

Establishes the processes for securing applications throughout their lifecycle, from design through development, testing, and deployment.

Description

Integrates security practices into the software development lifecycle (SDLC), including secure coding, DevSecOps, and application security testing (SAST, DAST, SCA).

Why This Domain Matters

Development speed increases while security resources remain limited, requiring developers to take greater ownership of security, often without adequate skills or tools.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        APP · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        12 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        APP-001 Application Security Program Establishes enterprise application secur...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-002 Application Inventory Establishes application inventory includ...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        APP-003 Secure Software Development Lifecycle (SSDLC) Establishes SSDLC including security req...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-004 Secure Coding Practices Establishes secure coding practices incl...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        APP-005 Application Security Testing Establishes application security testing...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-006 DevSecOps Establishes DevSecOps including CI/CD se...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        APP-007 Software Supply Chain Security Establishes software supply chain securi...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-008 API Security Establishes API security including authe...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-009 Secrets Management Establishes secrets management including...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        APP-010 Software Release & Deployment Security Establishes secure release and deploymen...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        APP-011 Application Security Incident Response Establishes application security inciden...
        Technical
        Corrective
        		 High Active 📋 10 Reqs View →
        APP-012 Application Risk Assessment Establishes application risk assessment...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        120 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        APP-001-R001 Application Security Governance The organization shall establish an appl... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R002 Security Program Scope The organization shall define a document... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R003 Roles & Responsibilities The organization shall clearly define an... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R004 Security Policies The organization shall establish applica... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R005 Security Metrics The organization shall define and track... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R006 Program Monitoring The organization shall monitor applicati... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R007 Executive Reporting The organization shall provide executive... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R008 Program Review The organization shall conduct periodic... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R009 Exception Management The organization shall manage exceptions... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-001-R010 Continuous Improvement The organization shall establish a conti... APP-001 Application Security Program CISO / Application Security Team View ↗
        APP-002-R001 Inventory Framework The organization shall establish an appl... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R002 Application Registration The organization shall register all appl... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R003 Application Classification The organization shall apply classificat... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R004 Ownership Assignment The organization shall assign explicit o... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R005 Lifecycle Status The organization shall maintain lifecycl... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R006 Inventory Validation The organization shall validate the appl... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R007 Inventory Monitoring The organization shall monitor the appli... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R008 Inventory Reporting The organization shall report on the app... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R009 Inventory Review The organization shall conduct periodic... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-002-R010 Continuous Improvement The organization shall establish a conti... APP-002 Application Inventory Application Portfolio Management / Application Security View ↗
        APP-003-R001 SSDLC Framework The organization shall establish a Secur... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R002 Security Requirements The organization shall define security r... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R003 Secure Design Review The organization shall conduct secure de... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R004 Threat Modeling The organization shall conduct threat mo... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R005 Secure Development The organization shall implement secure... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R006 Security Verification The organization shall conduct security... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R007 Security Validation The organization shall conduct security... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R008 Security Acceptance The organization shall establish securit... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R009 SDLC Review The organization shall conduct periodic... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-003-R010 Continuous Improvement The organization shall establish a conti... APP-003 Secure Software Development Li... Application Security / Engineering View ↗
        APP-004-R001 Secure Coding Standards The organization shall define secure cod... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R002 Developer Training The organization shall provide secure co... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R003 Code Review The organization shall conduct security-... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R004 Static Analysis The organization shall implement static... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R005 Coding Exceptions The organization shall manage exceptions... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R006 Coding Validation The organization shall validate that sec... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R007 Coding Metrics The organization shall define and track... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R008 Coding Reporting The organization shall report on secure... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R009 Coding Review The organization shall conduct periodic... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-004-R010 Continuous Improvement The organization shall establish a conti... APP-004 Secure Coding Practices Engineering / Application Security View ↗
        APP-005-R001 Security Testing Framework The organization shall establish an appl... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R002 SAST The organization shall implement Static... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R003 DAST The organization shall implement Dynamic... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R004 Interactive Testing (IAST) The organization shall implement Interac... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R005 Penetration Testing The organization shall conduct penetrati... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R006 Vulnerability Validation The organization shall validate applicat... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R007 Test Reporting The organization shall report on applica... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R008 Test Review The organization shall conduct periodic... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R009 Remediation Verification The organization shall verify that ident... APP-005 Application Security Testing Application Security / QA View ↗
        APP-005-R010 Continuous Improvement The organization shall establish a conti... APP-005 Application Security Testing Application Security / QA View ↗
        APP-006-R001 DevSecOps Framework The organization shall establish a DevSe... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R002 CI/CD Security The organization shall implement securit... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R003 Pipeline Security The organization shall secure CI/CD pipe... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R004 Build Security The organization shall implement securit... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R005 Artifact Security The organization shall implement securit... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R006 Infrastructure as Code Security The organization shall implement securit... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R007 Pipeline Monitoring The organization shall monitor DevSecOps... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R008 DevSecOps Reporting The organization shall report on DevSecO... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R009 Pipeline Review The organization shall conduct periodic... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-006-R010 Continuous Improvement The organization shall establish a conti... APP-006 DevSecOps DevSecOps / Platform Engineering View ↗
        APP-007-R001 Supply Chain Framework The organization shall establish a softw... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R002 SBOM Management The organization shall manage Software B... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R003 Third-Party Component Management The organization shall manage third-part... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R004 Open Source Security The organization shall manage open sourc... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R005 Dependency Management The organization shall manage software d... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R006 Component Verification The organization shall verify the integr... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R007 Supply Chain Monitoring The organization shall monitor software... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R008 Supply Chain Reporting The organization shall report on softwar... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R009 Supply Chain Review The organization shall conduct periodic... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-007-R010 Continuous Improvement The organization shall establish a conti... APP-007 Software Supply Chain Security Application Security / DevSecOps View ↗
        APP-008-R001 API Security Framework The organization shall establish an API... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R002 API Authentication The organization shall implement authent... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R003 API Authorization The organization shall implement authori... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R004 API Input Validation The organization shall implement input v... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R005 API Rate Limiting The organization shall implement rate li... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R006 API Monitoring The organization shall monitor API activ... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R007 API Security Testing The organization shall conduct security... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R008 API Reporting The organization shall report on API sec... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R009 API Review The organization shall conduct periodic... APP-008 API Security API Security / Application Engineering View ↗
        APP-008-R010 Continuous Improvement The organization shall establish a conti... APP-008 API Security API Security / Application Engineering View ↗
        APP-009-R001 Secrets Governance The organization shall establish a secre... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R002 Secret Inventory The organization shall maintain a compre... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R003 Secure Storage The organization shall implement secure... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R004 Secret Rotation The organization shall rotate secrets at... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R005 Secret Distribution The organization shall distribute secret... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R006 Secret Monitoring The organization shall monitor secrets t... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R007 Secret Audit The organization shall maintain comprehe... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R008 Secret Reporting The organization shall report on secrets... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R009 Secret Review The organization shall conduct periodic... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-009-R010 Continuous Improvement The organization shall establish a conti... APP-009 Secrets Management Application Security / Platform Engineering View ↗
        APP-010-R001 Release Security Framework The organization shall establish a softw... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R002 Release Approval The organization shall approve software... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R003 Deployment Validation The organization shall validate that sof... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R004 Deployment Integrity The organization shall implement control... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R005 Rollback Management The organization shall roll back softwar... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R006 Production Verification The organization shall conduct security... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R007 Deployment Monitoring The organization shall monitor software... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R008 Deployment Reporting The organization shall report on softwar... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R009 Deployment Review The organization shall conduct periodic... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-010-R010 Continuous Improvement The organization shall establish a conti... APP-010 Software Release & Deployment... Product Management / Application Security / Risk Owner View ↗
        APP-011-R001 Incident Response Framework The organization shall establish an appl... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R002 Application Incident Detection The organization shall detect security i... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R003 Incident Investigation The organization shall investigate appli... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R004 Containment The organization shall contain applicati... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R005 Recovery The organization shall recover from appl... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R006 Root Cause Analysis The organization shall conduct root caus... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R007 Incident Reporting The organization shall report on applica... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R008 Lessons Learned The organization shall capture and integ... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R009 Incident Review The organization shall conduct periodic... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-011-R010 Continuous Improvement The organization shall establish a conti... APP-011 Application Security Incident... Product Management / Application Security / Risk Owner View ↗
        APP-012-R001 Risk Assessment Framework The organization shall establish an appl... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R002 Risk Identification The organization shall identify security... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R003 Threat Assessment The organization shall conduct threat as... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R004 Business Impact Assessment The organization shall conduct business... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R005 Risk Scoring The organization shall apply consistent... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R006 Risk Treatment The organization shall define and implem... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R007 Risk Monitoring The organization shall monitor applicati... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R008 Risk Reporting The organization shall report on applica... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R009 Risk Review The organization shall conduct periodic... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗
        APP-012-R010 Continuous Improvement The organization shall establish a conti... APP-012 Application Risk Assessment Product Management / Application Security / Risk Owner View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED NIST SP 800-160 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (PR.DS) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED OWASP ASVS Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED OWASP Top 10 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED BSIMM Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED SAMM Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        PCI-DSS PCI DSS PCI DSS is an industry security standard...
        PCI
        Standard
        		 v4 View →
        NIST80053 NIST SP 800-53 (SA) NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →