Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle.
Also written as PR-PS-06, PR.PS-6, CSF 2.0 PR.PS-06, NIST CSF PR.PS.
PR.PS-06 is one of 22 subcategories in the Protect (PR) function, under the Platform Security category (PR.PS). The Core states: “Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle.” Protect outcomes are where most existing security spend already sits, so the usual gap is not the absence of a control but the absence of evidence that it covers the whole estate rather than the parts that were easy.
To demonstrate this outcome in an assessment or audit, gather artefacts such as:
PR.PS-06 corresponds to the following ISO 27001:2022 Annex A control(s): A.8.4, A.8.25, A.8.26, A.8.27, A.8.28, A.8.29, A.8.30. Evidence collected for one framework typically supports the other.
No. CSF 2.0 is a voluntary framework of outcomes rather than a set of requirements, and there is no certification against it. PR.PS-06 becomes binding only when something else makes it so — a contract, a regulator that references CSF, or your own Target Profile. That is the practical difference between CSF and an auditable standard like ISO 27001 or SOC 2.
Through profiles rather than pass/fail testing. You record how fully the outcome is achieved today in a Current Profile, state where it needs to be in a Target Profile, and the gap between them becomes your action plan. Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your governance around the outcome is, not whether you have met it.
The Protect function is normally owned by the security or IT function, but PR.PS-06 still needs a specific named owner. Assessors treat an outcome with no owner as not achieved regardless of the tooling behind it, so record ownership in your profile alongside the assessment.
Yes — PR.PS-06 corresponds to ISO 27001:2022 Annex A control(s) A.8.4, A.8.25, A.8.26, A.8.27, A.8.28, A.8.29, A.8.30. Evidence collected for one framework typically supports the other, so a single control library can serve both.