an for most modern frameworks 5.9 Verify that all input validation controls are Moved 2.0 Moved to V13 Malicious not affected by any malicious code controls 5.14 Verify that the runtime environment is not Merged 3.0 Merged with V5.13 susceptible to XML Injections or that security controls prevents XML Injections 5.15 -- EMPTY REQUIREMENT -- Deleted 3.0 This requirement never existed 5.19 Verify that for each type of output Merged 3.0 Genericized to include all encoding/escaping performed by the security controls and moved application, there is a single security control to 1.10 for that type of output for the intended destination 7.1 Verify that all cryptographic functions used Deprecated 3.0 Many modern responsive to protect secrets from the application user and mobile apps include this are implemented server side by design 7.3 Verify that access to any master secret(s) is 3.0 Moved to V2.29 protected from unauthorized access (A master secret is an application credential stored as plaintext on disk that is used to protect access to security configuration information). 7.4 Verify that password hashes are salted when 2.0 to V2.13 they are created 7.5 Verify that cryptographic module failures are Deprecated 2.0 Creating unnecessary logs logged that are reviewed is counterproductive 7.10 Verify that all code supporting or using a 2.0 to V13 cryptographic module is not affected by any malicious code 8.2 Verify that all error handling is performed on 3.0 Deprecated trusted devices
an for most modern frameworks 5.9 Verify that all input validation controls are not affected by any malicious code Moved 2.0 Moved to V13 Malicious controls 5.14 Verify that the runtime environment is not susceptible to XML Injections or that security controls prevents XML Injections Merged 3.0 Merged with V5.13 5.15 -- EMPTY REQUIREMENT -- Deleted 3.0 This requirement never existed 5.19 Verify that for each type of output encoding/escaping performed by the application, there is a single security control for that type of output for the intended destination Merged 3.0 Genericized to include all security controls and moved to 1.10 7.1 Verify that all cryptographic functions used to protect secrets from the application user are implemented server side Deprecated 3.0 Many modern responsive and mobile apps include this by design 7.3 Verify that access to any master secret(s) is protected from unauthorized access (A master secret is an application credential stored as plaintext on disk that is used to protect access to security configuration information). 3.0 Moved to V2.29 7.4 Verify that password hashes are salted when they are created 2.0 to V2.13 7.5 Verify that cryptographic module failures are logged Deprecated 2.0 Creating unnecessary logs that are reviewed is counterproductive 7.10 Verify that all code supporting or using a cryptographic module is not affected by any malicious code 2.0 to V13 8.2 Verify that all error handling is performed on trusted devices 3.0 Deprecated