CIS Control 16 manages the security life cycle of in house developed, hosted or acquired software, to prevent, detect and remediate weaknesses before they affect the enterprise. Evidence comes from pipeline checks, code review settings, test results, dependency scans and records of how found weaknesses were fixed.
Three kinds of software
CIS describes Control 16, "Application Software Security", as covering software you develop, software that is hosted for you and software you acquire. Many programs focus on the first and forget the other two.
The control language also names three actions: prevent, detect and remediate. A balanced evidence set touches all three for each kind of software.
Evidence grid
| Action | In house | Hosted or acquired |
|---|---|---|
| Prevent | Secure coding training, review rules, pull request gates | Supplier due diligence, contract terms, approval before adoption |
| Detect | Static analysis, dependency scans, dynamic tests | Advisory monitoring for products you use, SBOM requests |
| Remediate | Fix pull requests, tracked tickets, retest results | Patch tracking, supplier tickets, replacement decisions |
For acquired software, evidence often looks like a short assessment record kept with the purchase decision, plus a list of products and versions in use.
Steps to assemble it
- List your applications and tag each as in house, hosted or acquired.
- For in house code, export branch protection settings and the pipeline definition showing scanning steps.
- Keep scan outputs per release, and a record of what blocked a release and why.
- Record how findings were fixed, linking tickets to changes.
- For acquired software, keep the assessment, the version in use and the advisory subscription.
- Review the whole picture twice a year and write down gaps with owners.
Be selective about metrics. Coverage of repositories with required checks and time to fix are both easy to compute and hard to dispute.
Pitfalls
Applications with no owner. Test and staging environments that have weaker checks than production but handle real data. Acquired tools with no record of which version is in use. Findings closed without a retest.
A retest record is cheap and valuable. It shows the fix worked, which is the end of the remediate step.
Try it yourself
Try the static code scan demo and watch how a weakness is detected in source. Findings like this one feed the detect row of your evidence grid.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard supports policies, gates and guardrails on pull requests, plus compliance and evidence automation, so gate outcomes can be kept as records. You can try the free scan at gold.safeguard.sh/scan. Treat any export as input to your own review, not as a finding of compliance.
Quick check
Does Control 16 cover third party software?
The CIS overview names in house developed, hosted and acquired software, so yes. Keep assessment and version records for acquired products.
Which scans are required?
The overview does not name specific tools. Choose methods that fit your stack and show they run regularly.
Sources
- CIS Control 16: Application Software Security, Center for Internet Security
- CIS Controls list, Center for Internet Security
- CIS Controls v8.1, Center for Internet Security
Last reviewed: 19 October 2026.
