T/ISC 0042-2024 Software Security Development Capability Evaluation Technical Specification

Scope

Main technical content: In this standard, software in a broad sense includes software and application system software (which can be referred to as application systems) that support an organization's business. In a narrow sense, software refers to software developed by an organization and provided to third parties through sales or other models for use. Application system software is developed by an organization to meet the needs of a specific business and is used by the organization itself. When software and application systems are listed side by side, it refers to narrow-sense software; otherwise, it refers to broad-sense software. This standard specifies the security implementation requirements for various stages of software security development, including requirements, design, coding, testing, deployment/release, and operation and maintenance. It provides evaluation standards and bases for the capability of software security development processes. This standard specifies the requirements for practical activities of software and application security development systems at different levels, and is applicable to the evaluation and process improvement of an organization's own security development capabilities, as well as to the evaluation and certification of third-party software security development system capabilities.

Development Information

Related Standards