NIST CSF 2.0, IdentifyID.RA-09

Implement a system development life cycle framework for the secure development, acquisition and maintenance of technology systems, with security risk assessments for acquired software and systems and coding principles that cover the use of third-party and open-source code.

Employ cybersecurity professionals who hold a certification the Administration issues or recognizes, ensure the security of the supply chain of the technology products you use, obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system acquired by purchase, donation, development, or any other means, and ensure that any employee or officer with access to your critical assets holds a security clearance from the relevant government body.

If you operate a public network or provide a public service with increased hazard potential, use attack-detection systems that capture and evaluate threats continuously and automatically (Section 165(3)); as a network operator, use critical components only after a recognised certification body has examined and certified them (Section 165(4)), and undergo a review by a qualified independent body or competent national authority every two years, sending a copy of the report to the Bundesnetzagentur and the BSI and bearing the cost (Section 165(9)).

Where a Council of Ministers decree under Article 24 requires it, use the specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.