Control A.8.25Secure development life cycle
What it means in practice
Rules for the secure development of software and systems must be established and applied.
The parent control of the development family. It asks for the organisation’s rules to exist and to be applied across the life cycle — from requirements through design, coding, testing, release and maintenance.
What belongs in the rules: where security requirements come from (A.8.26), the design principles applied (A.8.27), coding practice (A.8.28), testing (A.8.29), environment separation (A.8.31), and how changes are controlled (A.8.32).
The point of a life cycle control is that security decisions made late are expensive and usually declined. A finding at design costs a conversation; the same finding at release costs a delay, and the delay is what makes it negotiable.
The rules have to fit how the organisation actually builds. A document describing a staged process, applied to teams releasing continuously, is ignored — and the gap between the documented life cycle and the real one is where the control silently stops existing.
How to put this in place
Flaws built in during development are costly to fix later and often reach customers. Your ISMS needs security built into how you design, build, test and release, in step with the tools your teams already use.
- Define the stages of your development life cycle and the security step at each.
- Write a short standard covering requirements, coding rules, review, testing and release.
- Build the steps into the pipeline so they are required, not optional.
- Record exceptions, such as emergency releases, and review them.
- Sample recent changes against the standard and improve it.
Evidence an auditor usually looks for: the secure development standard, pipeline configuration showing required steps, and a sample of changes that followed it.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists secure development rules among the documents auditors commonly expect for this control. - Word
Generative AI Security Standard
in Generative AI SecurityIts Framework References list this control. Supported by: Testing and Change control: a secure development life cycle applied to the feature. - Word
LLM Application Security Review Procedure
in Generative AI SecurityIts Framework References list this control. Supported by: Stages RP-1 to RP-7: security checked at each step in the life of the feature.