Application security governance establishes accountability and consistent security expectations throughout the application lifecycle.
Define application security roles, standards, risk criteria, required reviews, and evidence expectations. Align application security with enterprise risk, architecture, privacy, and compliance processes.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.5-IV – Review Frequency; §2.16-3.6 – Information Security assessment |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 6) Application Security Life Cycle (ASLC) – 6.1 Information security across all application lifecycle stages |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 7 – ICT systems, protocols and tools |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.26 – Application security requirements |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure Article 21(2)(f) – Policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 6.1.1 – All security policies and operational procedures that are identified in Requirement 6 are documented, kept up to date, in use, and known to all affected parties.; 6.2.1 – Bespoke and custom software are developed |
PCI
Standard
|
v4 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.17 – SYSTEM AND SERVICES ACQUISITION; SA-8 – SECURITY AND PRIVACY ENGINEERING PRINCIPLES |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Application Security Life Cycle |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. CC5.1 – Control Activities – COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |