Control A.8.29Security testing in development and acceptance
Security testing processes must be defined and implemented in the development life cycle.
Testing is where the assertions made by A.8.26 to A.8.28 are checked. The control asks for it to be in the life cycle — planned, with criteria, at defined points — rather than performed once before release.
The forms are complementary: static analysis of code, dependency and composition analysis, dynamic testing of running applications, and manual testing by people, which finds the logic flaws automation does not model. Acceptance testing against the security requirements is the step that closes the loop back to A.8.26.
Defining acceptance criteria in advance is what prevents the familiar release-day negotiation, where findings are re-graded under schedule pressure rather than fixed.
The limit worth stating in the organisation’s own process is what testing does not cover. A scan is evidence about a class of defects, not assurance about an application, and treating a clean scan as the latter is the most common misuse of this control.
How to put this in place
Testing for function alone misses security flaws. Your ISMS needs security testing before release and before you accept bought or built systems, so problems are found by you rather than by attackers.
- Decide which tests apply: automated tests in the pipeline, plus penetration testing for significant releases.
- Set a minimum frequency, such as yearly for exposed systems.
- Run the tests against the security requirements before acceptance.
- Log findings, fix them by severity and retest.
- Do not sign off acceptance until results are reviewed.
Evidence an auditor usually looks for: test plans and results, penetration test reports with remediation, and acceptance sign-offs.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.