Low Risk

Requirement
AS-1: Input Validation
AS-2: Parameterised Interfaces
AS-3: Output Sanitisation
AS-4: Authentication Mechanism Rate-Limiting
AS-5: Password Requirements
AS-6: Password Salting and Hashing
AS-7: Access Control Check Enforcement
AS-8: Application Secrets Management
AS-9: Content Security Policy (CSP)
AS-11: Session Management
SC-1: Code Repository
SC-3: Peer Review
SC-4: Dependency Manifest Version Pinning
SC-5: Automated Build and Deploy
SC-6: Dependency Installation during Deployment
ST-1: Vulnerability Assessment
ST-2: Cloud Security Posture Management
ST-3: Vulnerability Disclosure Programme
ST-4: Penetration Testing
ST-5: Vulnerability Management
NS-1: Public and Private Subnet Segmentation
NS-2: Access Restrictions on CSP Resources Outside Virtual Network
NS-3: Deny by Default - Allow by Exception
NS-4: Inter-Private Network Connectivity
NS-5: Network and Application Layer Filtering
NS-6: Valid and Trusted SSL/TLS Certificates
NS-7: Secure Inter-Service Communication
NS-8: Secure Government Enterprise Network (GEN) connectivity
NS-9: Intrusion Prevention System (IPS)/Intrusion Detection System (IDS)
NS-10: Private Network Connectivity
BR-1: Backup
BR-3: Backup Retention
DP-1: Data Residency
DP-2: Data at Rest Encryption
DP-3: Data in Transit Encryption
DP-4: Government on Commercial Cloud (GCC)
DP-5: Sanitisation
LM-1: Separate Log Storage
LM-2: Tamper-Resistant Log Storage
LM-3: Network Flow Logging
LM-4: Cloud Management Event Logging
LM-6: Access Logging
LM-7: Security Event Logging
LM-8: Security Log Retention
LM-9: Security Monitoring and Alerting
LM-10: Resource Usage Monitoring and Alerting
LM-12: Central Security Log Management and Monitoring
AC-1: Principle of Least Privilege
AC-2: Multi-Factor Authentication (MFA)
AC-3: Inactive and Expired Accounts
AC-4: Access Review
AC-5: Endpoint Device Hardening
AC-6: Default Credentials
AC-7: SingPass/CorpPass for External Users
AC-8: Automate account provisioning
AC-9: Endpoint Device Management
AC-12: Single Sign-On (SSO) for Internal Users
CS-3: Runtime Container Secrets
CS-4: Non-Privileged Container User
CS-7: Container Image Scanning
CS-9: Container Orchestrator API Access Control
CS-10: Container Workload Segmentation
PM-1: Cybersecurity Incident Management Plan
PM-2: Project Cybersecurity Risk Assessment
PM-3: System Security Plan (SSP) Development
PM-4: Approval of Policy Deviations
PM-5: Central Submission of Approved System Security Plan (SSP)
PM-6: System Documentation
PM-7: Certification
PM-8: Software as a Service (SaaS) Service Level Agreement
IS-1: Management Agents
IS-2: Automated Patch Management
IS-3: Restricted Administrator Privileges
IS-4: Least Functionality
IS-5: Host System Hardening
IS-6: Remote Administration
IS-7: Malware Protection
IS-9: End-of-Support (EOS) Assets
IS-10: Synchronise time clocks
IS-11: Central Domain Name Registration
IS-14: Singapore SMS Sender ID Registry Registration
SD-1: Push Protection for Secrets
SD-2: Default Branch Push Permissions
SD-4: Static Analysis
SD-5: Dependency Scanning
SD-6: Secret Detection
SD-7: CI Environment Variable Secrets Management
SD-8: Deployment Environment Segregation
DC-1: Separate hosting
DC-2: Physical Access Controls

Guideline
AS-10: HTTP Strict Transport Security (HSTS)
AS-12: Malware Scanning of Uploaded Files
SC-2: Commit Signing
SC-7: Software Artefact Signing
SC-8: Software Artefact Signature Verification
SC-9: Internal Code Collaboration and Sharing
NS-11: Alerts on Firewall Configuration Changes
BR-2: Recovery Testing
DP-6: Witness Sanitisation and Destruction of Storage Devices
LM-5: Database Logging
LM-11: Service Level Monitoring and Alerting
LM-13: Database Activity Monitoring
LM-14: Web Defacement Monitoring
LM-15: Structured Log Formatting
LM-16: Key Signals Monitoring
LM-17: Software delivery performance monitoring
AC-10: Identity and Device-Based Access Control
AC-11: Single User Endpoints
CS-1: Unique Base Container Image Tags
CS-2: Minimal Base Container Images
CS-5: Dockerfile Linting
CS-6: Read-Only Container Root Filesystem
CS-8: Private Container Image Registries
CS-11: Container Runtime Security
IS-8: Endpoint Detection and Response (EDR)
IS-12: DNS Security Extensions (DNSSEC)
IS-13: Defensive Domain Name Registration
SD-3: Continuous Integration (CI) Tests