CIS Controls v8

CIS 16 Application Software Security

Starts in IG2 | Integrate security controls into software delivery.

Implementation Actions

  • Define secure SDLC gates.
  • Run SAST/DAST/dependency checks.
  • Manage secrets and pipeline hardening.

Evidence Examples

  • Secure SDLC standard
  • Application scan results
  • Pipeline control records

Suggested Metrics

  • Critical app vulnerability MTTR
  • Release security gate pass rate