Skip to content

PW.2: Review the Software Design to Verify Compliance with Security Requirements and Risk Information

Help ensure that the software will meet the security requirements and satisfactorily address the identified risk information.

PW.2.1

Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the software design to confirm and enforce that it meets all of the security requirements and satisfactorily addresses the identified risk information.

Implementation Examples
  • Example 1: Review the software design to confirm that it addresses applicable security requirements.
  • Example 2: Review the risk models created during software design to determine if they appear to adequately identify the risks.
  • Example 3: Review the software design to confirm that it satisfactorily addresses the risks identified by the risk models.
  • Example 4: Have the software’s designer correct failures to meet the requirements.
  • Example 5: Change the design and/or the risk response strategy if the security requirements cannot be met.
  • Example 6: Record the findings of design reviews to serve as artifacts (e.g., in the software specification, in the issue tracking system, in the threat model).
References
  • BSAFSS: TV.3
  • BSIMM: AA1.1, AA1.2, AA1.3, AA2.1, AA3.1
  • EO14028: 4e(iv), 4e(v), 4e(ix)
  • IEC62443: SM-2, SR-2, SR-5, SD-3, SD-4, SI-2
  • ISO27034: 7.3.3
  • OWASPASVS: 1.1.5
  • OWASPSAMM: DR1-A, DR1-B
  • PCISSLC: 3.2
  • SP800181: T0328; K0038, K0039, K0070, K0080, K0119, K0152, K0153, K0161, K0165, K0172, K0297; S0006, S0009, S0022, S0036, S0141, S0171