# SP-012 Secure Software Development Lifecycle

Status: active. Release 26.02. Modified 2026-02-07. Licence: CC BY-SA 4.0.

Scope: End-to-end secure SDLC pattern covering threat modelling in design, secure coding standards, static and dynamic analysis, software composition analysis, security testing gates, vulnerability management, and secure release processes. Focuses on embedding security into the development process rather than bolting it on afterwards, with practical guidance for development teams, security champions, and AppSec functions.
Use when: This pattern applies to every organisation that develops or commissions software. It is particularly critical for: organisations developing internet-facing applications, SaaS providers processing customer data, financial services firms subject to DORA's ICT risk management requirements, organisations subject to PCI DSS requirement 6 (develop and maintain secure systems), healthcare organisations developing systems...
Not when: Organisations that exclusively use SaaS products and do no custom development do not need a full SSDL -- but they should still assess the SSDL practices of their SaaS vendors (see SA-04).

## Controls (26, NIST SP 800-53 ids)
- Critical (7): RA-05, SA-08, SA-11, SA-15, SI-02, SI-10, SR-03
- Important (13): AT-03, CA-02, CA-08, CM-02, CM-03, CM-04, IA-05, PL-08, RA-03, SA-04, SA-16, SI-06, SR-04
- Standard (6): AU-02, AU-12, CM-06, IR-06, SC-07, SI-04

## What each critical control mitigates (7)
- RA-05 Vulnerability Monitoring and Scanning: T-SDLC-002, T-SDLC-008, T-SDLC-010
- SA-08 Security and Privacy Engineering Principles: T-SDLC-001, T-SDLC-004, T-SDLC-006, T-SDLC-007, T-SDLC-009
- SA-11 Developer Testing and Evaluation: T-SDLC-001, T-SDLC-003, T-SDLC-004, T-SDLC-005, T-SDLC-006, T-SDLC-007, T-SDLC-008, T-SDLC-010
- SA-15 Development Process, Standards, and Tools: T-SDLC-003
- SI-02 Flaw Remediation: T-SDLC-010
- SI-10 Information Input Validation: T-SDLC-001, T-SDLC-007
- SR-03 Supply Chain Controls and Processes: T-SDLC-002, T-SDLC-005

## Threats and the controls that mitigate them (10)
- T-SDLC-001 Injection vulnerabilities (SQL, command, XSS) shipped to production: SA-11, SI-10, SA-08, AT-03
- T-SDLC-002 Known vulnerable third-party dependencies deployed in production: SR-03, RA-05, SA-04, SR-04
- T-SDLC-003 Hardcoded credentials or secrets committed to source repositories: SA-11, IA-05, SA-15, CM-04
- T-SDLC-004 Insecure authentication or session management enabling account takeover: SA-08, SA-11, CA-08, SC-07
- T-SDLC-005 Supply chain compromise through malicious dependency injection: SR-03, SR-04, SA-04, SA-11
- T-SDLC-006 Business logic flaws missed by automated tools enabling fraud or data exposure: SA-11, CA-08, SA-08, RA-03
- T-SDLC-007 Insecure deserialization enabling remote code execution: SA-11, SI-10, SA-08, CM-02
- T-SDLC-008 Security misconfiguration in deployment (verbose errors, default credentials, unnecessary services): CM-02, CM-06, SA-11, RA-05
- T-SDLC-009 Insufficient logging enabling undetected exploitation of application vulnerabilities: AU-02, AU-12, SA-08, SI-04
- T-SDLC-010 Delayed vulnerability remediation leaving known exposures in production: RA-05, SI-02, SA-11, CM-04

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-012/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-012/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 29 KB: /api/v1/patterns/SP-012
- Page for people: /patterns/sp-012/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-008 Public Web Server Pattern; SP-028 Secure DevOps Pipeline; SP-030 API Security; SP-035 Offensive Security Testing

This card, the API and the page are generated from one file. Checking one against another adds no evidence.