.png)
%20300xsomething.png)
What Is The Secure Code Alliance?
The SCA addresses two interconnected needs: ensuring software developers possess the technical skills to write secure code, and providing organizations with the means to demonstrate governance over secure development practices. Through individual certifications and organizational designations, it provides a framework that aligns with Executive Order 14028 requirements and NIST SP 800-218 best practices.
Technical competence and organizational due diligence are treated as separate problems with separate evidence. An individual earns a credential. An organization earns a designation. Neither substitutes for the other.
What Does The SCA Do?
The SCA certifies individuals for competency. As a personnel certification body, the SCA determines if an applicant fulfils certification requirements. Each applicant's subject matter expertise on selected voluntary consensus standards is tested to determine if an acceptable level of competency is met.
SCA certifications:
- Are meant to be a public statement or declaration that an individual has passed an examination and otherwise met specified criteria demonstrating that the individual has the competencies necessary to successfully perform the role and responsibilities that comprise a specific occupation;
- Must be renewed to ensure that individuals continue to possess the competencies required to perform the job; and
- May require ongoing education and/or assessment and/or experience for renewal.
Where The SCA Meets The SCF
The SCA appointed The Cyber AB to serve as the Accreditation Body for its organization-level certification scheme, and CODE conformity assessments are conducted using the methodology and infrastructure of the SCR Conformity Assessment Program (SCR CAP).
A Conformity Assessment Methodology For Secure Development
The SCA's mission is to improve the awareness and adherence to SSDP by application developers and architects through operating a conformity assessment methodology that:
- Spans the design, development and maintenance of applications, services and processes;
- Educates applicants through reinforcing reasonably-expected security and privacy principles, based on voluntary consensus standards that considered developer-specific industry-recognized practices; and
- Leverages an online platform to test applicants on subject matter expertise that awards the applicant with a Certificate of Conformity (CoC) upon receiving a successful score.
The methodology is designed with these concepts in mind:
- Identify the discipline basics for SSDP in terms of its principles, concepts and activities; and
- Foster a common mindset to deliver secure applications, services and processes, regardless of its purpose, type, scope, size, complexity, or stage of the SDLC.
Adequate Security & Privacy Throughout The SDLC
The SCA's vision is that organizations from all industries ensure that the development of applications, services and processes employ adequate security and privacy measures throughout the Software/System Development Life Cycle (SDLC) to ensure security and privacy-related risks are identified and remediated appropriately.
Two Paths For Individuals
Software developers and architects each face distinct challenges in secure development. The SCA offers two certifications, each tailored to the role and its responsibilities.
Certified SCA Practitioner (CSCAP)
For software developers who use Secure Development Lifecycle (SDL) processes for new systems, system upgrades, or systems that are being repurposed. Demonstrates technical competence in implementing SSDP day to day.
Certified SCA Architect (CSCAA)
For software architects who employ cyber resiliency constructs and tailor analytic and lifecycle processes to their environment. Demonstrates strategic and architectural security competence.
Govern Secure Development At Organizational Scale
There is a growing need for organizations to demonstrate that, at the organization level, they govern secure development practices. The SCA offers two paths, and an organization can pursue both.
Secure Development Organization (SDO)
Three levels of designation, where the level depends on the number of SCA Practitioners and SCA Architects employed by the organization.
Certified Organization for Development Excellence (CODE)
Two levels of third-party conformity assessment: CODE 1 against the CISA SSDAF, and CODE 2 against NIST SP 800-218.
Built For EO 14028 And The SSDF
Executive Order 14028, Improving the Nation's Cybersecurity, directs the National Institute of Standards and Technology to publish guidance on practices that enhance the security of the software supply chain. The SCA framework is designed to give organizations and individuals concrete, defensible evidence of those practices.
EO 14028
Improving the Nation's Cybersecurity. Directs NIST to publish guidance on practices that enhance the security of the software supply chain.
NIST SP 800-218
The Secure Software Development Framework (SSDF). The best-practices reference for SSDP, and the basis for CODE 2 conformity.
CISA SSDAF
The Secure Software Development Attestation Form, addressing EO 14028 requirements, and the basis for CODE 1 conformity.
%20(white).png)