CIS and SAFECode Update Secure Software Development Assessment Guide
Summary
CIS and SAFECode released version 1.1 of their Secure by Design assessment guide, expanding AI guidance, updating policy references, and strengthening the use of evidence to assess software security practices.
Key points
- Version 1.1 builds on the original guide rather than introducing a new framework.
- The update covers AI use in threat modeling, vulnerability identification and remediation, and risks from AI-generated code, AI-enabled applications, large language models, and agentic AI.
- AI-generated code should receive the same review, testing, and validation as human-written code.
- The guide updates references to CISA initiatives, NIST SSDF activities, Executive Order 14306, and the EU Cyber Resilience Act.
- Assessment materials map NIST SSDF practices to CIS Critical Security Controls, SAFECode Development Groups, organizational roles, and evidence requirements.
- The guide retains six focus areas: secure design, secure development, secure defaults, supply chain security, code integrity, and vulnerability remediation.
- It emphasizes demonstrating adoption with evidence such as threat models, testing results, vulnerability-management data, and source-code analysis outputs.
Article Details
- Event Type
- Release of version 1.1 of the Secure by Design: A Guide to Assessing Software Security Practices.
- Impact
- The updated guide adds guidance on AI in software development and security, reflects policy and regulatory developments, and strengthens resources for assessing software security practices using evidence. It is intended to help organizations evaluate and demonstrate Secure by Design adoption.