GB/T 47470-2026Cybersecurity technology - Assessment criteria for secure software development capability (English PDF)

5.1 Security Requirements Analysis

5.1.1 Process Description The security requirements analysis process consists of two process areas. establishing a security requirements baseline and supplementing security requirements. Security requirements are designed to achieve organizational goals. Driven by security objectives, we developed a system that aligns with the organization's business requirements through in-depth analysis of laws, regulations, industry oversight, and user access requirements. Establish a baseline of security requirements to ensure that the software complies with security standards during use, while protecting personal information and data security; through network security... The tracking and analysis of risks, including full-incident events, legacy testing defects, and potential vulnerabilities identified through threat modeling, will further inform the development of strategies to improve software security. Additional security requirements for the features. Organizations gain different levels of security requirements analysis capabilities by implementing basic practices in two process areas.

5.1.2 PA01 - Establishing a baseline for security requirements This process domain defines activities related to software compliance, personal information protection, data security, and enhancing software resilience, primarily including the following. content.

a) Summary Description. Analyze compliance requirements for information such as laws and regulations, user access, and industry standards, and identify security vulnerabilities in conjunction with business scenarios. Risk assessment involves establishing a baseline of security requirements tailored to the organization's business needs, ensuring that software meets security compliance, personal information protection, and data security requirements. According to security requirements, it possesses anti-attack capabilities;

b) Objective. To ensure the integrity of security requirements in software development and to guarantee that activity definitions meet basic security requirements;

c) Basic Practice Level Description. The establishment of a safety requirements baseline is divided into 3 levels and 6 basic practices, as shown in Table 1.

5.1.3 PA02 - Supplementary Safety Requirements This process area defines supplementary security requirement activities that enhance software security competitiveness based on the baseline security requirements. These mainly include the following. content.

a) Summary Description. Based on user access requirements, policies and regulations, known security issues in the application software, and legacy security testing issues, Threat modeling identifies security issues, security requirements to meet security strategic planning, and user security vulnerabilities, all within the framework of security needs. Based on the existing framework, security requirements were developed to enhance the software's security competitiveness.

b) Objective. Based on security vulnerabilities encountered by users during actual use, identify corresponding security needs and explore competitive advantages that can improve product security. The security requirements of competitiveness;

c) Basic Practice Level Description. Supplemental security requirements are divided into 3 levels and 5 basic practices, as shown in Table 2.

5.2 Security Technology Implementation

5.2.1 Process Description The process of implementing security technology includes designing a security architecture, managing open-source and third-party components, standardizing secure coding, reviewing code security, and implementing security measures. The entire build process consists of five process areas. Software architecture security analysis and design are crucial foundations for software security, and continuous optimization and improvement of the software architecture are essential. Design can effectively improve the efficiency of secure software development. Meeting the security and compliance requirements of open-source and third-party components is essential for secure implementation. Requirements. Standardized secure coding and code security reviews are essential means of ensuring code security. Organizations achieve different levels of security technology implementation capabilities by implementing basic practices in five process areas.

5.2.2 PA03 - Designing a Security Architecture This process domain defines an architecture analysis that meets security requirements and organizational policies, constructing a set of structural relationships with common components and security policies. The activities mainly include the following.

a) Overview. Implement security requirements, identify and mitigate security threats to the software architecture, conduct attack path analysis, and utilize security technologies. Design specifications, strengthen the implementation of security technologies, extract common security architecture from the organizational level, establish reusable assets, and improve development efficiency;

b) Objective. To analyze the security of the software architecture, improve its security design, and ensure software security at a more abstract, higher level;

c) Basic Practice Level Description. The design of a security architecture is divided into 4 levels and 7 basic practices, as shown in Table 3.

5.2.3 PA04 - Management of Open Source and Third-Party Components This process domain defines activities such as the inspection, management, and configuration of open-source and third-party components, the management, monitoring, and response to resource repositories, mainly including... Includes the following.

a) Overview. Establish reference standards for open-source and third-party components, manage the lifecycle of open-source and third-party components, and ensure the components... References can meet the needs of organizational definition;

b) Objective. To identify third-party commercially used and open-source components, confirm their security and compliance, and reduce the burden on the software development process. China introduces security risks from the outside.

c) Basic Practice Level Description. The management of open source and third-party components is divided into 3 levels and 7 basic practices, as shown in Table 4.

5.2.4 PA05 - Standard Security Coding This process domain defines the standardization activities for code security implementation, comment creation, resource usage, and compilation configuration, mainly including the following.

a) Overview. Establish secure coding standards, and propose specific security requirements for code writing on different operating systems and in different languages. Instructions for summation operations;

b) Objective. To guide developers in standardizing coding practices, improving program security and consistency, and reducing security vulnerabilities and code errors during the coding phase. risk;

c) Basic Practice Level Description. Standardized security coding is divided into 3 levels and 4 basic practices, as shown in Table 5.

5.3 Security Testing

5.3.1 Process Description The security testing process consists of two process areas. establishing security testing procedures and executing security tests. Security testing aims to discover security vulnerabilities. The purpose is to prevent various security problems in software caused by improper design or coding, and to verify that the software meets security requirements and security levels. The process of measuring targets. The proper use of security testing tools and the improvement of security testing techniques are effective means of discovering security vulnerabilities, and establishing organizational-level... Establish safety testing procedures, clarify operating specifications, accumulate testing experience, improve methods to increase test coverage, and effectively guide specific testing activities. implement. Organizations gain different levels of security testing capabilities by implementing basic practices in two process domains.

5.3.2 PA08 - Establish Safety Testing Procedures This process area defines the tools, procedures, test cases, and other activities for performing security testing on software, mainly including the following.

a) Summary Description. To reduce software security risks and minimize security vulnerabilities, based on software security requirements, constraints are clearly defined, and [the following is a summary description] is established. Establish safety testing procedures to guide the conduct of safety testing.

b) Objective. To establish test procedures that meet the organization's defined security policies and software security requirements, and to provide basic security testing methods. Processes and guidelines ensure the rationality of security test design, the correctness, effectiveness, and adequacy of test cases;

c) Basic Practice Level Description. The establishment of safety testing procedures is divided into 2 levels and 5 basic practices, as shown in Table 8.

5.3.3 PA09 - Perform security testing This process defines the requirements for conducting security testing activities, including testing known vulnerabilities, analyzing test data, and conducting adversarial security testing. Tests, attack tests, and tests with malformed input data, mainly include the following.

a) Summary Description. Security tests are performed on the software's security functions, security performance, and third-party component references according to the test plan. Record and analyze the test results, and incorporate them into the software quality measurement and analysis;

b) Objective. To verify that the software security design strategy has been implemented, meets software security requirements, and uncover security vulnerabilities;

c) Basic Practice Level Description. The performance of security testing is divided into 4 levels and 8 basic practices, as shown in Table 9.

5.6 Safety Management

5.6.1 Process Description The security governance process consists of three process areas. security planning, compliance management, and security development and training. The purpose of security governance is to address security issues at the group level. At the organizational level, clearly define security objectives and build a security system. This involves establishing a software security governance system encompassing organizational structure, personnel, processes, and technology, and implementing security measures. The accumulation and reuse of assets throughout the entire process ensures the safe and effective operation of various businesses, helps organizations effectively control compliance risks, and achieve organizational strategy. The security objective. Organizations achieve different levels of security governance capabilities by implementing basic practices across three process areas.

5.6.2 PA14 - Safety Planning This process domain defines organizational security goals, establishes a software security development process system, and clarifies process connections through organizational structure and responsibilities. Activities such as division of labor and performance evaluation optimization mainly include the following.

a) Summary Description. Strategically plan the organization's overall software security development system construction goals and directions, and define performance indicators to ensure... Implementation of relevant policies;

b) Objective. The software security development system supports the achievement of organizational security goals; therefore, it is generally promoted from a high-level strategic perspective. This ensures that the relevant activities can be carried out smoothly;

c) Explanation of Basic Practice Levels. Safety planning is divided into 3 levels and 7 basic practices, as shown in Table 14.

5.6.3 PA15 - Compliance Management This process domain clearly defines the organization's requirements to comply with national, regional, and industry safety regulations, interpret and analyze the dynamics of laws, regulations, and standards, and apply the latest... Best practices include conducting compliance audits and management of both themselves and their suppliers, which mainly include the following.

a) Summary Description. Through benchmarking analysis of laws, regulations, and standards, practical experience, and supplier compliance management, ensure the organization's software products are sold reliably. Safety and compliance of camp activities;

b) Objective. To ensure that the software products and supporting services meet the legal, regulatory, and standard requirements of the countries and regions where they are sold, and to guarantee the software products... This enhances the organization's competitiveness and, consequently, enables its sustainable development.

c) Explanation of Basic Practice Levels. Compliance management is divided into 3 levels and 6 basic practices, as shown in Table 15.

5.6.4 PA16 - Security Development Training This process domain supports the establishment and maintenance of training capabilities for various roles within the organization, developing personnel's skills and knowledge to enable them to perform tasks efficiently. They should define the security development training requirements for their roles, which mainly include the following.

a) Summary Description. Organize specialized training for internal and external personnel, guide the implementation of secure development technologies, share lessons learned, and interpret policies and regulations. The goal is to ensure that staff at all levels of the organization understand and prioritize safe development, and to guarantee the implementation of safe development requirements.

b) Objective. To ensure that personnel at each stage of the software development process meet the corresponding security capability requirements;

c) Basic Practice Level Description. Security development training is divided into 3 levels and 5 basic practices, as shown in Table 16.

5.7 Development Support

5.7.1 Process Description The development support process consists of two process areas. tool environment security and configuration management. The purpose of the development support process is to improve the software lifecycle. Improve the efficiency of the execution of the five major security processes and related security activities, reduce the risk of security vulnerabilities introduced by the related processes, and develop support processes during implementation. Use it in conjunction with other technologies during development activities. Organizations gain different levels of development support capabilities by implementing basic practices in two process areas.

5.7.2 PA17 - Tool and Environmental Safety This process area is implemented during the software development process to ensure the security of the technical tools used and the development and testing environments involved. The activities mainly include the following.

a) Overview. Provides resource support for security technology tools during the software development process, including auditing and hardening these tools. Protective measures are in place to ensure the security of the development environment and prevent software source code leaks or malicious code injection due to tool security issues. Risks, etc.

b) Objective. To ensure the security and compliance of security technology tools and development environments, and to guarantee the accuracy of software execution results;

c) Basic Practice Level Description. Tool environment safety is divided into 3 levels and 5 basic practices, as shown in Table 17.

5.7.3 PA18 - Configuration Management This process domain defines activities related to the implementation, monitoring, and review of security configurations for software, services, and networks, and mainly includes the following.

a) Summary Description. Manage the integrity of work products using configuration identification, version control, change control, and auditing;

b) Objective. To reduce losses in security software development efforts and increase the ability to provide users with the correct version of the solution;

c) Basic Practice Level Description. Configuration management is divided into 3 levels and 7 basic practices, as shown in Table 18.

5.8 Safety Measurement and Improvement

5.8.1 Process Description The safety measurement and improvement process consists of two process areas. safety measurement and safety problem analysis and resolution. The purpose of safety measurement and improvement is... It involves measuring activities throughout the software lifecycle, using statistical and quantitative techniques to analyze security data, and objectively reflecting the software security development process. To understand the true state of processes and software, identify existing problems and areas for improvement, and predict future developments in software security. Organizations achieve different levels of safety measurement and improvement capabilities by implementing basic practices in two process areas.

5.8.2 PA19 - Safety Measurement Security metrics are the methods used in the software security development process to define and implement metrics, indicators, and techniques for measuring inputs, results, and the environment. Tools, metrics analysis, and other activities.

a) Overview. Focus the management of software security development on input, results, and environmental performance to maximize the organization's satisfaction. Security objectives.

b) Objective. To use metrics to manage software security development quality and process performance.

c) Basic Practice Level Description. Safety measurement is divided into 5 levels and 9 basic practices, as shown in Table 19.

5.8.3 PA20 - Safety Issues Analysis and Resolution This process area is defined as ensuring the sustainability of business processes by analyzing and addressing security issues that arise during the software lifecycle. The investigation and continuous improvement of software security quality activities mainly include the following.

a) Summary Description. Introduce defect management for security identification, identify common issues in security incidents, improve the development process, and prevent similar incidents. The problem occurred again;

b) Objective. To identify software security vulnerabilities, select typical security incident issues, conduct root cause analysis and solutions, and improve through data analysis. Improve the performance of the secure development process and enhance software quality and production efficiency;

c) Explanation of Basic Practice Levels. Safety problem analysis and resolution is divided into 5 levels and 9 basic practices, as shown in Table 20.