Control A.8.29Security testing in development and acceptance
What it means in practice
Security testing processes must be defined and implemented in the development life cycle.
Testing is where the assertions made by A.8.26 to A.8.28 are checked. The control asks for it to be in the life cycle — planned, with criteria, at defined points — rather than performed once before release.
The forms are complementary: static analysis of code, dependency and composition analysis, dynamic testing of running applications, and manual testing by people, which finds the logic flaws automation does not model. Acceptance testing against the security requirements is the step that closes the loop back to A.8.26.
Defining acceptance criteria in advance is what prevents the familiar release-day negotiation, where findings are re-graded under schedule pressure rather than fixed.
The limit worth stating in the organisation’s own process is what testing does not cover. A scan is evidence about a class of defects, not assurance about an application, and treating a clean scan as the latter is the most common misuse of this control.
How to put this in place
Testing for function alone misses security flaws. Your ISMS needs security testing before release and before you accept bought or built systems, so problems are found by you rather than by attackers.
- Decide which tests apply: automated tests in the pipeline, plus penetration testing for significant releases.
- Set a minimum frequency, such as yearly for exposed systems.
- Run the tests against the security requirements before acceptance.
- Log findings, fix them by severity and retest.
- Do not sign off acceptance until results are reviewed.
Evidence an auditor usually looks for: test plans and results, penetration test reports with remediation, and acceptance sign-offs.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
LLM Application Security Review Procedure
in Generative AI SecurityIts Framework References list this control. Supported by: Stage RP-5: security testing before release and at each review. - Word
AI Red Team Test Plan Template
in Generative AI SecurityIts Framework References list this control. Supported by: The whole template: security testing of a system before acceptance, planned and recorded.