Outsourcing IT systems and software development to external parties has many benefits for businesses such as reduced cost and greater scalability. However, these efficiencies should not come at the cost of security.
For example, external service providers may not have strict access controls for networks in place or may fail to apply industry-level encryption to data stored in the cloud, leading to the compromise of IT systems and software products.
This may result in data breaches and loss of availability, confidentiality, or integrity of information assets.
According to a report by Trustwave, outsourcing of software and IT development played a role in more than 60% of all data breaches.
Considering that outsourcing inevitably leads to loss of control over the development process and makes it harder to apply and maintain information security requirements, organisations should ensure that external parties comply with the information security requirements set out by the organisation.
Control 8.30 enables organisations to ensure that the established information security requirements are adhered to when the system and software development is outsourced to external suppliers.
Control 8.30 is both detective and preventive in nature: It requires organisations to supervise and monitor all outsourcing activities and to ensure that the outsourced development process satisfies information security requirements.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive #Detective | #Confidentiality #Integrity #Availability | #Identify #Protect #Detect | #System and Network Security #Application Security #Supplier Relationship Security | #Governance and Ecosystem #Protection |
Chief Information Security Officer should be responsible for establishing and implementing necessary procedures and controls to ensure those information security requirements are communicated to, agreed by and complied with by external suppliers.
General guidance highlights that organisations should continuously monitor and verify that the delivery of outsourced development work satisfies the information security requirements imposed on the external service provider.
Control 8.30 recommends organisations take into account the following 11 factors when outsourcing development:
For more detailed guidance on managing supplier relationships, organisations can refer to ISO/IEC 27036.
27002:2022/8.30 replace 27002:2013/(14.2.7)
Overall, there is no material difference between the two versions.
Companies can use ISMS.Online to help them with their ISO 27002 compliance efforts by providing them with a platform that makes it easy to manage their security policies and procedures, update them as needed, test them and monitor their effectiveness.
Our cloud-based platform allows you to quickly and easily manage all the aspects of your ISMS, including risk management, policies, plans, procedures and more, in one central location. The platform is easy to use and has an intuitive interface that makes it simple to learn how to use.
Get in touch today to book a demo.
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
