What is ISO 27002 Control 8.25 and Why It Matters?

In the 90’s, businesses used to perform security tests for software products and systems only during the testing stage, at the final phase of the software development life cycle.

As a result, they often failed to detect and eliminate critical vulnerabilities, bugs, and flaws.

To identify and address security vulnerabilities early on, organisations should embed security considerations into all stages of the development life cycle, from the planning to the deployment stage.

Control 8.25 deals with how organisations can set out and implement rules to build secure software products and systems.

Purpose of Control 8.25

Control 8.25 enables organisations to design information security standards and apply these standards across the entire secure development life cycle for software products and systems.

Attributes Table of Control 8.25

Control 8.25 is preventive in nature as it requires organisations to proactively design and implement rules and controls that govern the whole development life cycle for every new software product and system.

Control Type Information Security Properties Cybersecurity Concepts Operational Capabilities Security Domains
#Preventive #Confidentiality #Protect #Application Security #Protection
#Integrity #System and Network Security
#Availability



Get an 81% headstart

We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.

Book a demo



Ownership of Control 8.25

The Chief Information Security Officer should be responsible for the creation, implementation, and maintenance of rules and measures for ensuring the security of the development life cycle.

General Guidance on Compliance

Control 8.25 contains 10 requirements that organisations should comply with to build secure software products, systems, and architecture:

  1. Development, test, and production environments should be segregated as per Control 8.31.
  2. Organisations should provide guidance on:
    • Security considerations in the software development methodology in accordance with Control 8.27 and 8.28.
    • Secure coding for each programming language in accordance with 8.28.

  3. Organisations should establish and implement security requirements that apply to the specification and design phase in accordance with Control 5.8.
  4. Organisations should define security checklists for the projects as per Control 5.8.
  5. Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.
  6. Organisations should create safe repositories storing source codes and configuration in compliance with Controls 8.4 and 8.9.
  7. Organisations should maintain security in the version control as prescribed in Control 8.32.
  8. Organisations should ensure all personnel involved in the development has sufficient application security knowledge and are provided with the necessary training as defined in Control 8.28.
  9. Developers should be capable of identifying and preventing security vulnerabilities as set out in Control 8.28.
  10. Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.

Furthermore, if an organisation outsources certain development tasks to external parties, it must ensure that the external party adheres to the organisation’s rules and procedures for the secure development of software and system.

Supplementary Guidance on Control 8.25

Control 8.25 notes that software products, architectures, and systems can also be developed within applications, databases, or browsers.




Manage all your compliance in one place

ISMS.online supports over 100 standards
and regulations, giving you a single
platform for all your compliance needs.

Book a demo



Changes and Differences from ISO 27002:2013

27002:2022/8.25 replace 27002:2013/(14.2.1)

Overall, there are two key differences.

The ISO 27002:2022 Version Sets Two New Requirements

While the 2022 version is similar to the 2013 Version to great extent, the Control 8.25 imposes two new requirements on organisations:

  • Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.
  • Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.

The ISO 27002:2013 Version Explicitly Referred to the Code Re-Use

The 2013 version explicitly stated that the Control 14.2.1 applies to both new developments and to code re-use. In contrast, Control 8.25 did not refer to code re-use scenarios.

New ISO 27002 Controls

New Controls


Organisational Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
5.105.1.1, 05.1.2Policies for information security
5.206.1.1Information security roles and responsibilities
5.306.1.2Segregation of duties
5.407.2.1Management responsibilities
5.506.1.3Contact with authorities
5.606.1.4Contact with special interest groups
5.7NewThreat intelligence
5.806.1.5, 14.1.1Information security in project management
5.908.1.1, 08.1.2Inventory of information and other associated assets
5.1008.1.3, 08.2.3Acceptable use of information and other associated assets
5.1108.1.4Return of assets
5.12 08.2.1Classification of information
5.1308.2.2Labelling of information
5.1413.2.1, 13.2.2, 13.2.3Information transfer
5.1509.1.1, 09.1.2Access control
5.1609.2.1Identity management
5.17 09.2.4, 09.3.1, 09.4.3Authentication information
5.1809.2.2, 09.2.5, 09.2.6Access rights
5.1915.1.1Information security in supplier relationships
5.2015.1.2Addressing information security within supplier agreements
5.2115.1.3Managing information security in the ICT supply chain
5.2215.2.1, 15.2.2Monitoring, review and change management of supplier services
5.23NewInformation security for use of cloud services
5.2416.1.1Information security incident management planning and preparation
5.2516.1.4Assessment and decision on information security events
5.2616.1.5Response to information security incidents
5.2716.1.6Learning from information security incidents
5.2816.1.7Collection of evidence
5.2917.1.1, 17.1.2, 17.1.3Information security during disruption
5.30NewICT readiness for business continuity
5.3118.1.1, 18.1.5Legal, statutory, regulatory and contractual requirements
5.3218.1.2Intellectual property rights
5.3318.1.3Protection of records
5.3418.1.4Privacy and protection of PII
5.3518.2.1Independent review of information security
5.3618.2.2, 18.2.3Compliance with policies, rules and standards for information security
5.3712.1.1Documented operating procedures


People Controls


Physical Controls


How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.

  • Up to 81% progress from when you log in.
  • Simple and total compliance solution.

Get in touch today to book a demo.


Jump to topic

Max Edwards

Max works as part of the ISMS.online marketing team and ensures that our website is updated with useful content and information about all things ISO 27001, 27002 and compliance.

ISMS Platform Tour

Interested in an ISMS.online platform tour?

Start your free 2-minute interactive demo now and experience the magic of ISMS.online in action!

Try it for free

We’re a Leader in our Field

Users Love Us
Leader Winter 2025
Leader Winter 2025 United Kingdom
Best ROI Winter 2025
Fastest Implementation Winter 2025
Most Implementable Winter 2025

"ISMS.Online, Outstanding tool for Regulatory Compliance"

-Jim M.

"Makes external audits a breeze and links all aspects of your ISMS together seamlessly"

-Karen C.

"Innovative solution to managing ISO and other accreditations"

-Ben H.

DORA is here! Supercharge your digital resilience today with our powerful new solution!