---
type: CisControl
id: https://w3id.org/lmodel/cis-controls/knowledge/controls/control-16
title: Control 16
description: "Control 16 of the CIS Controls, Version 8.1, which the edition file titles Secure applications in the project's own words: it holds 14 Safeguards, 16.1 to 16.14, of which none is in Implementation Group 1, 11 in Implementation Group 2 and all 14 in Implementation Group 3."
cis_control_id: "16"
resource: https://www.cisecurity.org/controls/v8-1
definedBy:
  - https://w3id.org/lmodel/cis-controls/knowledge/references/cis-controls-guide
relatedTo:
  - https://w3id.org/lmodel/cis-controls/knowledge/glossary/control
sources:
  - id: cis-v8-1
    resource: https://www.cisecurity.org/controls/v8-1
    title: the guide this page offers, v8.1.2 of March 2025, read on 2026-10-30
  - id: edition
    resource: src/cis_controls/data/cis-controls-8.1.2.yaml
    title: Control 16 and its Safeguards
generated:
  by: process:ktl-librarian
  at: "2026-10-31T12:14:49Z"
status: draft
---

# Control 16

Control 16 is one of the 18 Controls of the CIS Controls, Version 8.1. CIS's guide, at its v8.1.2 revision, lists 14 Safeguards under it, numbered 16.1 to 16.14.[^cis-v8-1] The schema uses those numbers as their identifiers. Of the Safeguards, none is in Implementation Group 1, 11 in Implementation Group 2 and all 14 in Implementation Group 3. Its Safeguards are about the asset classes Software (9), Documentation (3), Network (1) and Users (1).

This bundle leaves out CIS's name and description for the Control and CIS's text for its Safeguards, because CIS licenses that text under CC BY-NC-ND 4.0; CIS's guide gives them, and [the guide's reference](../references/cis-controls-guide.md) says where to find it. The edition file gives the Control and each of its Safeguards a title and a description in the project's own words, written from what each requires.[^edition] For Control 16 they are:

- **Title:** Secure applications
- **Description:** Managing the security of software the enterprise develops, hosts or buys throughout its life, so that weaknesses are prevented, found and fixed before they cause harm.

[^cis-v8-1]: <https://www.cisecurity.org/controls/v8-1>, the guide this page offers, the Safeguards of Control 16
[^edition]: src/cis_controls/data/cis-controls-8.1.2.yaml, Control 16 and its Safeguards