CISSP Central

8.5 Define and apply secure coding guidelines and standards
8.5.1 Security weaknesses and vulnerabilities at the source-code level
8.5.2 Security of application programming interfaces (API)
8.5.3 Secure Coding Practices
8.5.4 Software-defined security

8.3 Assess the effectiveness of software security
8.3.1 Auditing and logging of changes
8.3.2 Risk analysis and mitigation
8.4 Assess security impact of acquired software
8.4.1 Commercial-off-the-shelf (COTS)
8.4.2 Open Source
8.4.3 Third-Party
8.4.4 Managed Services (e.g.., enterprise applications)
8.4.5 Cloud Services (e.g.., SaaS, IaaS, PaaS)

8.2 Identify & apply security controls in development environments
8.2.1 Programming languages
8.2.2 Libraries
8.2.3 Tool sets
8.2.4 Integrated Development Environment (IDE)
8.2.5 Runtime
8.2.6 Continuous Integration and Continuous Delivery (CI / CD)
8.2.7 Software Configuration Management (SCM)
8.2.8 Code Repositories
8.2.9 Application security testing (e.g., SAST, DAST, IAST & SCA)

8.1 Understand and integrate security in the software development lifecycle
8.1.1 Development Methodologies
8.1.2 Maturity Models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
8.1.3 Operations & Maintenance
8.1.4 Change Management
8.1.5 Integrated Product Team (IPT)

7.13 Participate in Business Continuity (BC) planning and exercises
7.14 Implement and manage physical security
7.15 Address personnel safety and security concerns
7.15.1 Travel
7.15.2 Security Training & Awareness
7.15.3 Emergency Management
7.15.4 Duress