Application Security
Information about the programs and tools that support information and system security in the development of applications at CMS
Application Security at CMS is focused on proactively mitigating risk in the development lifecycle – building securely from the start. With rapidly evolving cyber threats, system teams become the first line of defense to ensure that tools and products are developed with a strong emphasis on security and privacy.
The resources provided below give teams access to the latest APIs, tools, apps, programs, and services that empower you to ship software securely, continuously, and with confidence. They are a starting point to help you plug into trusted tools and code used at CMS for modern security best practices. Together, we'll continue our mission to reduce risk across CMS systems and build trust with the people we serve.
CMS Cloud Services
Platform-As-A-Service with tools, security, and support services designed specifically for CMS. (Requires CMS login)
Top documents and resources
The CMS ISPG SAF program was discontinued in September 2023. The open-source tools and baseline validation content will still be maintained.
Design practices that facilitate secure software development through organization and collaboration
Information and resources for teams to help them initiate and complete their system threat model
Your internal CMS resource for the latest in cloud-based tools and programs, with support to help you find what you need
Continuous authorization and verification platform for faster development and improved security
Filtered view of related content using CyberGeek Search
