Security testing identifies vulnerabilities that may not be visible through design review or code inspection alone.
Use risk-appropriate SAST, DAST, IAST, penetration testing, dependency analysis, and other testing techniques. Track findings through remediation and verify closure.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 16 – Application Software Security: 16.12 – Implement Code-Level Security Checks |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI03 – Managed Solutions Identification and Build > BAI03.06 – Perform quality assurance (QA). 4.3 – Build, Acquire and Implement (BAI) > BAI03 – Managed Solutions Identification and Build > BAI03.08 – Execute solution testing. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 25 – Testing of ICT tools and systems Article 24(2) – Appropriate digital operational resilience tests |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.5-3.1.2 – Application security standards |
India
Guideline
|
vLatest | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.26 – Application security requirements; 8.29 – Security testing in development and acceptance |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure Article 21(2)(f) – Policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-8 – PENETRATION TESTING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Application Security Life Cycle |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 6.1.1 – All security policies and operational procedures that are identified in Requirement 6 are documented, kept up to date, in use, and known to all affected parties.; 6.2.1 – Bespoke and custom software are developed |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 6) Application Security Life Cycle (ASLC) – 6.2 Source-code audit or assurance of critical applications; 6) Application Security Life Cycle (ASLC) – 6.6 Threat modelling, secure coding, security testing and secure rollout; 7) Patch/Vulnerability & Change Management – 7.5 Periodic application security testing throughout lifecycle in production-like environment; 18) Vulnerability assessment and Penetration Test and Red Team Exercises – 18.3 Qualified teams for public-facing and critical-application penetration testing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.1 – System Operations – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |