ISO 27002:2022 introduces several new and updated information security controls including A8.28 – Secure coding, which amends previous A14 controls for secure software development.
Below is a brief look of what is required.
Secure coding in ISO 27002:2022
The new control ID 8.28 – Secure coding has been added to ISO/IEC 27002:2022 to ensure software and code is written securely to reduce potential information security vulnerabilities.
The control includes a requirement for secure coding principles, previously Secure Engineering Principles (A.14.2.5) which should be applied during software development.
The organisation should monitor real world threats and have access to up-to-date advice including information on vulnerabilities which may exist within existing software or open source packages used. The organisation’s secure coding principles should incorporate continual improvement and learning to help ensure effective secure coding practices are implemented to combat the fast-changing threat landscape.
How to Evidence A8.28 of ISO 27002:2022
Organisations can evidence control A8.28 through a documented policy that includes:
- Planning and prerequisites before coding such as:
- Expectations for secure coding to be used in both in-house and outsourced code developments,
- Agreed common coding practices,
- Configuring development tools,
- During coding such as :
- Agreed secure coding practices specific to the programming languages and techniques being used,
- Programming techniques, including peer review or code and test-driven development using recognised techniques,
- Structured documentation of code.
- Testing should be conducted during and after development and may include recognised databases such as:
How to Implement A8.28 of ISO 27002:2022
The most common way to implement secure coding is through policies, procedures or other documentation such as Wikis and Knowledge Base articles which can be communicated to developers or included as part of their training and awareness.
Once the principles have been established, they can be maintained through the quality assurance or peer review process.
If you need assistance with ISO 27002:2022 control A8.28, Assent’s ISO 27002 Consultants can help. Contact us to discuss how we can help with this ISO 27002 Control and the ISO 27001 Information Security Management System in general.
