In the 90’s, businesses used to perform security tests for software products and systems only during the testing stage, at the final phase of the software development life cycle.
As a result, they often failed to detect and eliminate critical vulnerabilities, bugs, and flaws.
To identify and address security vulnerabilities early on, organisations should embed security considerations into all stages of the development life cycle, from the planning to the deployment stage.
Control 8.25 deals with how organisations can set out and implement rules to build secure software products and systems.
Control 8.25 enables organisations to design information security standards and apply these standards across the entire secure development life cycle for software products and systems.
Control 8.25 is preventive in nature as it requires organisations to proactively design and implement rules and controls that govern the whole development life cycle for every new software product and system.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Application Security #System and Network Security | #Protection |
The Chief Information Security Officer should be responsible for the creation, implementation, and maintenance of rules and measures for ensuring the security of the development life cycle.
Control 8.25 contains 10 requirements that organisations should comply with to build secure software products, systems, and architecture:
Furthermore, if an organisation outsources certain development tasks to external parties, it must ensure that the external party adheres to the organisation’s rules and procedures for the secure development of software and system.
Control 8.25 notes that software products, architectures, and systems can also be developed within applications, databases, or browsers.
27002:2022/8.25 replace 27002:2013/(14.2.1)
Overall, there are two key differences.
While the 2022 version is similar to the 2013 Version to great extent, the Control 8.25 imposes two new requirements on organisations:
The 2013 version explicitly stated that the Control 14.2.1 applies to both new developments and to code re-use. In contrast, Control 8.25 did not refer to code re-use scenarios.
ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.
Get in touch today to book a demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
