Control A.8.30Outsourced development
The organisation must direct, monitor and review the activities related to outsourced system development.
Outsourced development is supplier risk with code as the deliverable, and the three verbs set the expectation: direct — the organisation’s secure development requirements apply to the supplier and are in the contract under A.5.20; monitor — the work is observed as it happens rather than assessed at delivery; review — the output is examined, including by testing under A.8.29.
The practical questions are ownership of code and rights of access to it, the supplier’s own development practice and its supply chain, the handling of any production or personal data used in development, and what happens to the environment and the credentials at the end.
The failure that recurs is acceptance without inspection. Code delivered, tested functionally and deployed, with no security review and no knowledge of what dependencies it brought with it, is an unexamined addition to the estate that the organisation will own for years.
How to put this in place
When a supplier writes your software, its flaws and working practices become yours. Your ISMS needs your secure development expectations in the contract, and checks that they were met.
- List the development suppliers and the systems they build; if there are none, record that as the reason this control does not apply.
- Write requirements into the contract: secure practices, code ownership, testing and vulnerability fixing.
- Agree your right to see test results and review code.
- Review delivered work before accepting it.
- Monitor delivery and record issues raised, then remove supplier access when the work ends.
Evidence an auditor usually looks for: contracts with development suppliers, and evidence of reviews and testing of delivered code.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.