NIS2 Art.21.2e: Security in Network and Information Systems Acquisition, Development and Maintenance

Start by establishing a secure systems development lifecycle (SSDLC) that covers every phase: requirements, design, implementation, testing, deployment, and maintenance. Every new system or major change should have documented security requirements. Adopt secure coding standards that fit your technology stack. Train your developers on common vulnerability classes like the OWASP Top 10 and CWE Top 25. Integrate static application security testing (SAST) and dynamic application security testing (DAST) into your CI/CD pipeline so issues are caught early. For procurement, build security requirements into vendor specifications. Evaluate commercial off-the-shelf products before deployment and confirm that vendor support and patching commitments meet your needs. Set up a vulnerability management programme with regular scanning - at least monthly for internet-facing systems, quarterly for internal ones. Subscribe to relevant advisories and threat intelligence feeds. Define a clear triage process and set remediation SLAs by severity. Create a patch management process with firm timelines. Critical vulnerabilities on internet-facing systems should be patched within days. Everything else follows a risk-based schedule. Publish a coordinated vulnerability disclosure (CVD) policy. It should give external researchers a clear reporting channel, define your response timelines, and outline how you handle public disclosure. Finally, maintain a complete inventory of software and hardware assets with version information. This underpins both vulnerability management and patch tracking. Pair it with a change management process that includes security review for anything touching production.