6.1.1Processes and mechanisms for developing and maintaining secure systems and software are defined and understood

Defined Approach Requirements:

All security policies and operational procedures that are identified in Requirement 6 are:

- Documented.

- Kept up to date.

- In use.

- Known to all affected parties.

Defined Approach Testing Procedures:

6.1.1 Examine documentation and interview personnel to verify that security policies and operational procedures identified in Requirement 6 are managed in accordance with all elements specified in this requirement