---
title: "Build software securely"
description: "Build software securely, family Build, NIS2 Art. 21(2)(e)"
url: https://www.alt-f1.be/en/table/sd/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Build software securely

Short label: SOFTWARE

Family: Build · NIS2 Art. 21(2)(e)
<a id="meaning"></a>

## Meaning

Use reviewed changes, component checks, controlled releases and a maintenance process when building software.

<a id="why"></a>

## Why it matters

Clear records make it easier to understand what runs, assess a vulnerable component and recover from a failed change.

<a id="actions"></a>

## What you can do

Define review and testing steps, record components and responsibilities, and plan updates and recovery.

## Services that can help

Custom Software follows an agreed delivery and operating process. Sovereign Code supports source control and credential checks; product obligations depend on scope and role.

- [Custom Software](https://www.alt-f1.be/en/custom-software.md)
- [Sovereign Code](https://www.alt-f1.be/en/sovereign-code.md)

## Official reference — NIS2 Art. 21(2)(e)

> 2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
>
> — Directive (EU) 2022/2555 (NIS2), Art. 21(2)

> (e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 21(2)(e)

**What this reference concerns:** Security must be built in when you buy, build or maintain systems, and known vulnerabilities must be handled and disclosed.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555#art_21) · Official text, quoted from the Official Journal of the EU