Control A.8.28Secure coding

Secure coding principles must be applied to software development.

New in the 2022 edition as an explicit control. It covers the practices that prevent the vulnerability classes that recur: input handling, output encoding, authentication and session management, error handling that does not leak, and the safe use of cryptographic and other libraries.

The control reaches beyond the code the organisation writes. Most applications are mostly dependencies, so the secure use of components — knowing what is included, keeping it current, and checking it comes from where it claims to — is part of coding securely, and connects to A.5.21 and A.8.4.

What makes this work in practice is tooling in the path developers already use — analysis in the pipeline, dependency checks, and review — rather than a standard nobody reads. And it depends on A.8.29’s testing to tell whether the principles are being applied, since the only evidence otherwise is the absence of discovered defects.