Control A.8.25Secure development life cycle
Rules for the secure development of software and systems must be established and applied.
The parent control of the development family. It asks for the organisation’s rules to exist and to be applied across the life cycle — from requirements through design, coding, testing, release and maintenance.
What belongs in the rules: where security requirements come from (A.8.26), the design principles applied (A.8.27), coding practice (A.8.28), testing (A.8.29), environment separation (A.8.31), and how changes are controlled (A.8.32).
The point of a life cycle control is that security decisions made late are expensive and usually declined. A finding at design costs a conversation; the same finding at release costs a delay, and the delay is what makes it negotiable.
The rules have to fit how the organisation actually builds. A document describing a staged process, applied to teams releasing continuously, is ignored — and the gap between the documented life cycle and the real one is where the control silently stops existing.
How to put this in place
Flaws built in during development are costly to fix later and often reach customers. Your ISMS needs security built into how you design, build, test and release, in step with the tools your teams already use.
- Define the stages of your development life cycle and the security step at each.
- Write a short standard covering requirements, coding rules, review, testing and release.
- Build the steps into the pipeline so they are required, not optional.
- Record exceptions, such as emergency releases, and review them.
- Sample recent changes against the standard and improve it.
Evidence an auditor usually looks for: the secure development standard, pipeline configuration showing required steps, and a sample of changes that followed it.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists secure development rules among the documents auditors commonly expect for this control.