{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-760.50","name":"Application & Data Security","level":2,"parent_id":"BC-760","l1_id":"BC-760","industry":"cross-industry","macro_id":"MC-70","path":["Cybersecurity","Application & Data Security"],"description":"Build security into the software the enterprise writes and buys, and protect the data it holds through encryption, key control and controls on where data may go.","aliases":["AppSec","Data Protection","Secure Development"],"in_scope":["Secure development practices and training","Application security testing before and after release","Encryption and key management","Data loss prevention and monitoring"],"out_of_scope":["Functional and performance testing (see BC-720)","Data classification policy itself (see BC-750)"],"csdm_note":null,"status":"active","successor_id":null,"child_ids":["BC-760.50.10","BC-760.50.20","BC-760.50.30","BC-760.50.40"]},"crosswalk":{"realized_by":[{"product_id":"PR-140","product":"Microsoft 365","pc_id":"PC-140.70","pc":"Microsoft Purview","maturity":"partial","via":null},{"product_id":"PR-170","product":"GitHub","pc_id":"PC-170.50","pc":"Advanced Security","maturity":"strong","via":null},{"product_id":"PR-180","product":"Snowflake","pc_id":"PC-180.40","pc":"Governance","maturity":"strong","via":null}],"used_in":[{"vs_id":"VS-100","vs":"Commit-to-Production","stage_id":"VS-100.20","stage":"Test & Secure","order":2,"via":null},{"vs_id":"VS-80","vs":"Demand-to-Change","stage_id":"VS-80.30","stage":"Design & Review","order":3,"via":null}],"patterns":[{"id":"DP-350","name":"Secrets Management","category":"Security","via":"BC-760.50.30"}],"stacks":[],"books":[{"id":"BK-threat-modeling","title":"Threat Modeling","topic":"Security","via":null},{"id":"BK-security-engineering","title":"Security Engineering","topic":"Security","via":null}]},"ancestors":[{"id":"BC-760","name":"Cybersecurity","level":1}],"children":[{"id":"BC-760.50.10","name":"Secure Development Practices","level":3,"child_count":0},{"id":"BC-760.50.20","name":"Application Security Testing","level":3,"child_count":0},{"id":"BC-760.50.30","name":"Encryption & Key Management","level":3,"child_count":0},{"id":"BC-760.50.40","name":"Data Loss Prevention","level":3,"child_count":0}]}