Objective 8.1 · high
Security in the SDLC
Embed requirements, design, threat modeling, coding, testing, release, operation, change, and disposal controls into development lifecycles.
- Lesson
- d8-lesson
- Practice pool
- d8-questions
- Application
- cissp-s10
CISSP · D8 · 10%
Software Development Security
Integrate security into development methods, environments, testing, acquired software, coding, deployment, operation, and software supply-chain governance.
Provider facts checked 2026-08-03
Objective coverage
Objective 8.2 · high
Development-ecosystem controls
Protect repositories, pipelines, dependencies, artifacts, environments, credentials, tools, test data, and separation of duties.
- Lesson
- d8-lesson
- Practice pool
- d8-questions
- Application
- cissp-s10
Objective 8.3 · high
Software security effectiveness
Assess architecture, code, dependencies, runtime, tests, defects, remediation, coverage, and risk trends.
- Lesson
- d8-lesson
- Practice pool
- d8-questions
- Application
- cissp-s10
Objective 8.4 · high
Acquired software
Apply supplier requirements, contracts, provenance, assessment, acceptance, maintenance, vulnerability, escrow, and end-of-life controls.
- Lesson
- d8-lesson
- Practice pool
- d8-questions
- Application
- cissp-s10
Objective 8.5 · high
Secure coding
Address common software weaknesses through language/framework controls, review, testing, dependency hygiene, secrets protection, and safe error handling.
- Lesson
- d8-lesson
- Practice pool
- d8-questions
- Application
- cissp-s10
title: "Software Development Security" summary: "Lifecycle decisions for embedding security requirements, architecture, testing, assurance, and governance into software delivery."
Security across the software lifecycle
Embed security in requirements, architecture, threat modeling, design, coding, review, testing, release, operation, change, vulnerability response, and disposal across predictive, iterative, agile, DevOps, and other development approaches.
Protect repositories, branches, reviews, build systems, runners, dependencies, registries, artifacts, credentials, test data, environments, deployments, and separation of duties. Establish provenance and promote the same verified artifact; do not rebuild unknown code between stages.
Assess architecture, code, dependencies, interfaces, runtime, misuse cases, static/dynamic analysis, composition analysis, fuzzing, penetration tests, defects, coverage, remediation, and risk trends. No single test provides complete assurance.
For acquired software and services, define security requirements, supplier evidence, contractual duties, provenance, acceptance, vulnerabilities, patching, access, data, monitoring, incident notice, escrow where appropriate, end-of-life, and exit. Secure coding addresses input, output, authorization, sessions, secrets, errors, memory, concurrency, injection, dependency, and framework-specific risks.
Self-check
Make a release decision for software containing a critical supplier component with incomplete assurance. Identify mandatory criteria, compensating controls, residual risk owner, monitoring, contractual action, rollback, and exit.