CISSP Domain7 Section 11

8.5 Define and apply secure coding guidelines and standards8.5.1 Security weaknesses and vulnerabilities at the source-code level8.5.2 Security of application programming interfaces (API)8.5.3 Secure Coding Practices8.5.4 Software-defined security

8.3 Assess the effectiveness of software security8.3.1 Auditing and logging of changes8.3.2 Risk analysis and mitigation8.4 Assess security impact of acquired software8.4.1 Commercial-off-the-shelf (COTS)8.4.2 Open Source8.4.3 Third-Party8.4.4 Managed Services (e.g.., enterprise applications)8.4.5 Cloud Services (e.g.., SaaS, IaaS, PaaS)

8.2 Identify & apply security controls in development environments8.2.1 Programming languages8.2.2 Libraries8.2.3 Tool sets8.2.4 Integrated Development Environment (IDE)8.2.5 Runtime8.2.6 Continuous Integration and Continuous Delivery (CI / CD)8.2.7 Software Configuration Management (SCM)8.2.8 Code Repositories8.2.9 Application security testing (e.g., SAST, DAST, IAST & SCA)

8.1 Understand and integrate security in the software development lifecycle8.1.1 Development Methodologies8.1.2 Maturity Models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))8.1.3 Operations & Maintenance8.1.4 Change Management8.1.5 Integrated Product Team (IPT)

7.13 Participate in Business Continuity (BC) planning and exercises7.14 Implement and manage physical security7.15 Address personnel safety and security concerns7.15.1 Travel7.15.2 Security Training & Awareness7.15.3 Emergency Management7.15.4 Duress

7.12 Test Disaster Recovery Plans7.12.1 Read-through/Checklist7.12.2 Walk-through/Tabletop7.12.3 Simulation7.12.4 Parallel7.12.5 Full Interruption7.12.6 Communications (e.g., stakeholders, test status, regulators)

7.11 Implement Disaster Recovery Process7.11.1 Response7.11.2 Personnel7.11.3 Communications7.11.4 Assessment7.11.5 Restoration7.11.6 Training & Awareness7.11.7 Lessons Learned

7.8 Implement and support patch and vulnerability management7.9 Understand and participate in change management processes7.10 Implement recovery strategies7.10.1 Backup storage strategies7.10.2 Recovery site strategies7.10.3 Multiple processing sites7.10.4 System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance (FT)

7.7 Operate and maintain detection and preventative measures7.7.1 Firewall7.7.2 Intrusion detection and prevention systems7.7.3 Whitelisting/Blacklisting7.7.4 Third-party provided security services7.7.5 Sandboxing7.7.6 Honeypots / Honeynets7.7.7 Anti-malware7.7.8 Machine learning and artificial intelligence (AI) based tools

7.6 Conduct incident management7.6.1 Detection7.6.2 Response7.6.3 Mitigation7.6.4 Reporting7.6.5 Recovery7.6.6 Remediation7.6.7 Lessons Learned