Pillar 3: Application & Workload
Secure everything from applications to hypervisors, containers, and virtual machines — including the DevSecOps pipeline that builds and deploys them.
Key principles
- Security is embedded in the development lifecycle, not bolted on at deployment.
- Workloads are segmented and authenticated to each other, not implicitly trusted by network location.
- Application access is authorized per-request, informed by user and device trust signals.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Manual code review, flat network trust between app tiers |
| Advanced | Automated SAST/DAST in CI/CD, service-mesh or NGFW-based segmentation |
| Optimal | Runtime self-protection (RASP), fully dynamic identity-based segmentation per workload |
Related capabilities
See Secure Software Development Lifecycle and Application-Layer Micro-Segmentation in the capability matrix.
Framework tie-ins
NIST 800-53 (SA family), NIST 800-207 §3.4, PCI-DSS v4.0 (Req. 1.3, 6).
Capabilities in this pillar
Application-Layer Micro-Segmentation
Flat network, coarse VLAN segmentation
Workload-aware segmentation via service mesh or NGFW policies
Fully dynamic, identity-based segmentation per workload/session
Secure Software Development Lifecycle
Manual code review, ad hoc testing
Automated SAST/DAST in CI/CD with gated deploys
Continuous security validation with runtime application self-protection (RASP)
Payment & Transaction Integrity Controls
Manual dual-control sign-off on high-value transactions
Automated dual-control with anomaly-based transaction holds
Real-time, ML-based transaction risk scoring integrated into the release/approval workflow
Third-Party Software & Vendor Risk Management
Annual vendor security questionnaires
Continuous vendor security ratings and SBOM review for critical vendors
Automated, continuous third-party risk scoring gating production integration