Security in development and support processes i. Contractor has implemented procedures to maintain the security of application system software and information;
ii. Contractor utilizes formal change control procedures to implement changes; and
iii. Contractor supervises and monitors outsourced software development.
Security in development and support processes. To protect Supplier Information Processing Systems and system files containing Confidential Information, Supplier will:
(a) Ensure that the implementation of changes is controlled by the use of formal change control procedures;
(b) Employ appropriate industry best practice security controls to minimize information leakage;
(c) Employ oversight quality controls and security management of software development; and
(d) Employ system, application and source code scanning and analysis tools and a framework for remediation of findings.
9.4.1 Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted system hardening standards as defined, for example, by SysAdmin Audit Network Security Institute (SANS), National Institute of Standards Technology (NIST), and Center for Internet Security (CIS).
Security in development and support processes. To protect Provider Information Processing Systems and system files containing Recipient Confidential Information, Provider will:
10.2.1 Ensure that the implementation of changes is controlled by the use of formal change control procedures.
10.2.2 Employ appropriate industry best practice security controls to minimize information leakage.
Security in development and support processes. The Contractor shall put in place appropriate rules to govern the development of secure software and systems development. Changes to systems (both applications and operating systems) should be controlled and documented. Software packages should be modified only in exceptional circumstances, and secure system engineering principles should be followed. The Contractor is responsible for ensuring the development environment is secure, and that any outsourced development is properly vetted and controlled. System security should be tested and acceptance criteria defined to include all appropriate security aspects.
Security in development and support processes. To protect Information Processing System(s) and system files containing Protected Information, TrueCar will:
i. Use a formal change control process to implement Information Processing System(s) changes to minimize the risk of system changes.
ii. Use security controls to minimize information leakage.
iii. Perform quality control and security management oversight of outsourced software development.
