Control 8.25, Secure Development Life Cycle

What is ISO 27002 Control 8.25 and Why It Matters?

In the 90’s, businesses used to perform security tests for software products and systems only during the testing stage, at the final phase of the software development life cycle.

As a result, they often failed to detect and eliminate critical vulnerabilities, bugs, and flaws.

To identify and address security vulnerabilities early on, organisations should embed security considerations into all stages of the development life cycle, from the planning to the deployment stage.

Control 8.25 deals with how organisations can set out and implement rules to build secure software products and systems.

Purpose of Control 8.25

Control 8.25 enables organisations to design information security standards and apply these standards across the entire secure development life cycle for software products and systems.

Attributes Table of Control 8.25

Control 8.25 is preventive in nature as it requires organisations to proactively design and implement rules and controls that govern the whole development life cycle for every new software product and system.

Control Type	Information Security Properties	Cybersecurity Concepts	Operational Capabilities	Security Domains
#Preventive	#Confidentiality	#Protect	#Application Security	#Protection
	#Integrity		#System and Network Security
	#Availability

ISMS.online gives you an 81% Headstart from the moment you log on

ISO 27001 made easy

We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.

Get started

Ownership of Control 8.25

The Chief Information Security Officer should be responsible for the creation, implementation, and maintenance of rules and measures for ensuring the security of the development life cycle.

General Guidance on Compliance

Control 8.25 contains 10 requirements that organisations should comply with to build secure software products, systems, and architecture:

Development, test, and production environments should be segregated as per Control 8.31.
Organisations should provide guidance on:

Security considerations in the software development methodology in accordance with Control 8.27 and 8.28.
Secure coding for each programming language in accordance with 8.28.

Organisations should establish and implement security requirements that apply to the specification and design phase in accordance with Control 5.8.
Organisations should define security checklists for the projects as per Control 5.8.
Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.
Organisations should create safe repositories storing source codes and configuration in compliance with Controls 8.4 and 8.9.
Organisations should maintain security in the version control as prescribed in Control 8.32.
Organisations should ensure all personnel involved in the development has sufficient application security knowledge and are provided with the necessary training as defined in Control 8.28.
Developers should be capable of identifying and preventing security vulnerabilities as set out in Control 8.28.
Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.

Furthermore, if an organisation outsources certain development tasks to external parties, it must ensure that the external party adheres to the organisation’s rules and procedures for the secure development of software and system.

Supplementary Guidance on Control 8.25

Control 8.25 notes that software products, architectures, and systems can also be developed within applications, databases, or browsers.

ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.

Book your demo

Changes and Differences from ISO 27002:2013

27002:2022/8.25 replace 27002:2013/(14.2.1)

Overall, there are two key differences.

The ISO 27002:2022 Version Sets Two New Requirements

While the 2022 version is similar to the 2013 Version to great extent, the Control 8.25 imposes two new requirements on organisations:

Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.
Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.

The ISO 27002:2013 Version Explicitly Referred to the Code Re-Use

The 2013 version explicitly stated that the Control 14.2.1 applies to both new developments and to code re-use. In contrast, Control 8.25 did not refer to code re-use scenarios.

New ISO 27002 Controls

New Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
5.7	NEW	Threat intelligence
5.23	NEW	Information security for use of cloud services
5.30	NEW	ICT readiness for business continuity
7.4	NEW	Physical security monitoring
8.9	NEW	Configuration management
8.10	NEW	Information deletion
8.11	NEW	Data masking
8.12	NEW	Data leakage prevention
8.16	NEW	Monitoring activities
8.23	NEW	Web filtering
8.28	NEW	Secure coding

Organisational Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
5.1	05.1.1, 05.1.2	Policies for information security
5.2	06.1.1	Information security roles and responsibilities
5.3	06.1.2	Segregation of duties
5.4	07.2.1	Management responsibilities
5.5	06.1.3	Contact with authorities
5.6	06.1.4	Contact with special interest groups
5.7	NEW	Threat intelligence
5.8	06.1.5, 14.1.1	Information security in project management
5.9	08.1.1, 08.1.2	Inventory of information and other associated assets
5.10	08.1.3, 08.2.3	Acceptable use of information and other associated assets
5.11	08.1.4	Return of assets
5.12	08.2.1	Classification of information
5.13	08.2.2	Labelling of information
5.14	13.2.1, 13.2.2, 13.2.3	Information transfer
5.15	09.1.1, 09.1.2	Access control
5.16	09.2.1	Identity management
5.17	09.2.4, 09.3.1, 09.4.3	Authentication information
5.18	09.2.2, 09.2.5, 09.2.6	Access rights
5.19	15.1.1	Information security in supplier relationships
5.20	15.1.2	Addressing information security within supplier agreements
5.21	15.1.3	Managing information security in the ICT supply chain
5.22	15.2.1, 15.2.2	Monitoring, review and change management of supplier services
5.23	NEW	Information security for use of cloud services
5.24	16.1.1	Information security incident management planning and preparation
5.25	16.1.4	Assessment and decision on information security events
5.26	16.1.5	Response to information security incidents
5.27	16.1.6	Learning from information security incidents
5.28	16.1.7	Collection of evidence
5.29	17.1.1, 17.1.2, 17.1.3	Information security during disruption
5.30	5.30	ICT readiness for business continuity
5.31	18.1.1, 18.1.5	Legal, statutory, regulatory and contractual requirements
5.32	18.1.2	Intellectual property rights
5.33	18.1.3	Protection of records
5.34	18.1.4	Privacy and protection of PII
5.35	18.2.1	Independent review of information security
5.36	18.2.2, 18.2.3	Compliance with policies, rules and standards for information security
5.37	12.1.1	Documented operating procedures

People Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
6.1	07.1.1	Screening
6.2	07.1.2	Terms and conditions of employment
6.3	07.2.2	Information security awareness, education and training
6.4	07.2.3	Disciplinary process
6.5	07.3.1	Responsibilities after termination or change of employment
6.6	13.2.4	Confidentiality or non-disclosure agreements
6.7	06.2.2	Remote working
6.8	16.1.2, 16.1.3	Information security event reporting

Physical Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
7.1	11.1.1	Physical security perimeters
7.2	11.1.2, 11.1.6	Physical entry
7.3	11.1.3	Securing offices, rooms and facilities
7.4	NEW	Physical security monitoring
7.5	11.1.4	Protecting against physical and environmental threats
7.6	11.1.5	Working in secure areas
7.7	11.2.9	Clear desk and clear screen
7.8	11.2.1	Equipment siting and protection
7.9	11.2.6	Security of assets off-premises
7.10	08.3.1, 08.3.2, 08.3.3, 11.2.5	Storage media
7.11	11.2.2	Supporting utilities
7.12	11.2.3	Cabling security
7.13	11.2.4	Equipment maintenance
7.14	11.2.7	Secure disposal or re-use of equipment

Technological Controls

ISO/IEC 27002:2022 Control Identifier	ISO/IEC 27002:2013 Control Identifier	Control Name
8.1	06.2.1, 11.2.8	User endpoint devices
8.2	09.2.3	Privileged access rights
8.3	09.4.1	Information access restriction
8.4	09.4.5	Access to source code
8.5	09.4.2	Secure authentication
8.6	12.1.3	Capacity management
8.7	12.2.1	Protection against malware
8.8	12.6.1, 18.2.3	Management of technical vulnerabilities
8.9	NEW	Configuration management
8.10	NEW	Information deletion
8.11	NEW	Data masking
8.12	NEW	Data leakage prevention
8.13	12.3.1	Information backup
8.14	17.2.1	Redundancy of information processing facilities
8.15	12.4.1, 12.4.2, 12.4.3	Logging
8.16	NEW	Monitoring activities
8.17	12.4.4	Clock synchronization
8.18	09.4.4	Use of privileged utility programs
8.19	12.5.1, 12.6.2	Installation of software on operational systems
8.20	13.1.1	Networks security
8.21	13.1.2	Security of network services
8.22	13.1.3	Segregation of networks
8.23	NEW	Web filtering
8.24	10.1.1, 10.1.2	Use of cryptography
8.25	14.2.1	Secure development life cycle
8.26	14.1.2, 14.1.3	Application security requirements
8.27	14.2.5	Secure system architecture and engineering principles
8.28	NEW	Secure coding
8.29	14.2.8, 14.2.9	Security testing in development and acceptance
8.30	14.2.7	Outsourced development
8.31	12.1.4, 14.2.6	Separation of development, test and production environments
8.32	12.1.2, 14.2.2, 14.2.3, 14.2.4	Change management
8.33	14.3.1	Test information
8.34	12.7.1	Protection of information systems during audit testing

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.