Ensuring Information Security in Outsourced Development: ISO 27002 Control 8.30
Outsourcing IT systems and software development to external parties has many benefits for businesses such as reduced cost and greater scalability. However, these efficiencies should not come at the cost of security.
For example, external service providers may not have strict access controls for networks in place or may fail to apply industry-level encryption to data stored in the cloud, leading to the compromise of IT systems and software products.
This may result in data breaches and loss of availability, confidentiality, or integrity of information assets.
According to a report by Trustwave, outsourcing of software and IT development played a role in more than 60% of all data breaches.
Considering that outsourcing inevitably leads to loss of control over the development process and makes it harder to apply and maintain information security requirements, organisations should ensure that external parties comply with the information security requirements set out by the organisation.
Purpose of Control 8.30
Control 8.30 enables organisations to ensure that the established information security requirements are adhered to when the system and software development is outsourced to external suppliers.
Attributes of Control 8.30
Control 8.30 is both detective and preventive in nature: It requires organisations to supervise and monitor all outsourcing activities and to ensure that the outsourced development process satisfies information security requirements.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Identify | #System and Network Security | #Governance and Ecosystem |
| #Detective | #Integrity | #Protect | #Application Security | #Protection |
| #Availability | #Detect | #Supplier Relationship Security |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 8.30
Chief Information Security Officer should be responsible for establishing and implementing necessary procedures and controls to ensure those information security requirements are communicated to, agreed by and complied with by external suppliers.
General Guidance on Compliance
General guidance highlights that organisations should continuously monitor and verify that the delivery of outsourced development work satisfies the information security requirements imposed on the external service provider.
Control 8.30 recommends organisations take into account the following 11 factors when outsourcing development:
- Entering into agreements, including licensing agreements, that addresses ownership over code and intellectual property rights.
- Imposing appropriate contractual requirements for secure design and coding in line with Control 8.25 and 8.29.
- Establishing a threat model to be adopted by third-party developers.
- Carrying out an acceptance testing procedure to ensure the quality and accuracy of delivered work.
- Evidence that minimally-required privacy and security capabilities are achieved. This may be achieved via assurance reports.
- Keeping evidence of how sufficient testing has been performed to protect the delivered IT system or software against malicious content.
- Keeping evidence of how sufficient testing has been applied to protect against identified vulnerabilities.
- Putting in place escrow agreements that cover the software source code. For example, it may address what will happen if the external supplier goes out of business.
- The agreement with the supplier should entail the right of the organisation to perform audits on development processes and controls.
- Establishing and implementing security requirements for the development environment.
- Organisations should also consider applicable laws, statutes, and regulations.
Supplementary Guidance
For more detailed guidance on managing supplier relationships, organisations can refer to ISO/IEC 27036.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/8.30 replaces 27002:2013/(14.2.7)
Overall, there is no material difference between the two versions.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
Companies can use ISMS.Online to help them with their ISO 27002 compliance efforts by providing them with a platform that makes it easy to manage their security policies and procedures, update them as needed, test them and monitor their effectiveness.
Our cloud-based platform allows you to quickly and easily manage all the aspects of your ISMS, including risk management, policies, plans, procedures and more, in one central location. The platform is easy to use and has an intuitive interface that makes it simple to learn how to use.
Get in touch today to book a demo.
