What is ISO 27002 Control 8.25 and Why It Matters?
In the 90’s, businesses used to perform security tests for software products and systems only during the testing stage, at the final phase of the software development life cycle.
As a result, they often failed to detect and eliminate critical vulnerabilities, bugs, and flaws.
To identify and address security vulnerabilities early on, organisations should embed security considerations into all stages of the development life cycle, from the planning to the deployment stage.
Control 8.25 deals with how organisations can set out and implement rules to build secure software products and systems.
Purpose of Control 8.25
Control 8.25 enables organisations to design information security standards and apply these standards across the entire secure development life cycle for software products and systems.
Attributes Table of Control 8.25
Control 8.25 is preventive in nature as it requires organisations to proactively design and implement rules and controls that govern the whole development life cycle for every new software product and system.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Application Security | #Protection |
| #Integrity | #System and Network Security | |||
| #Availability |
Get an 81% headstart
We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.
Ownership of Control 8.25
The Chief Information Security Officer should be responsible for the creation, implementation, and maintenance of rules and measures for ensuring the security of the development life cycle.
General Guidance on Compliance
Control 8.25 contains 10 requirements that organisations should comply with to build secure software products, systems, and architecture:
- Development, test, and production environments should be segregated as per Control 8.31.
- Organisations should provide guidance on:
- Security considerations in the software development methodology in accordance with Control 8.27 and 8.28.
- Secure coding for each programming language in accordance with 8.28.
- Organisations should establish and implement security requirements that apply to the specification and design phase in accordance with Control 5.8.
- Organisations should define security checklists for the projects as per Control 5.8.
- Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.
- Organisations should create safe repositories storing source codes and configuration in compliance with Controls 8.4 and 8.9.
- Organisations should maintain security in the version control as prescribed in Control 8.32.
- Organisations should ensure all personnel involved in the development has sufficient application security knowledge and are provided with the necessary training as defined in Control 8.28.
- Developers should be capable of identifying and preventing security vulnerabilities as set out in Control 8.28.
- Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.
Furthermore, if an organisation outsources certain development tasks to external parties, it must ensure that the external party adheres to the organisation’s rules and procedures for the secure development of software and system.
Supplementary Guidance on Control 8.25
Control 8.25 notes that software products, architectures, and systems can also be developed within applications, databases, or browsers.
Manage all your compliance in one place
ISMS.online supports over 100 standards
and regulations, giving you a single
platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/8.25 replace 27002:2013/(14.2.1)
Overall, there are two key differences.
The ISO 27002:2022 Version Sets Two New Requirements
While the 2022 version is similar to the 2013 Version to great extent, the Control 8.25 imposes two new requirements on organisations:
- Organisations should comply with licensing requirements and should evaluate the feasibility of alternative cost-effective methods as prescribed in Control 8.30.
- Organisations should perform security and system testing such as penetration tests and code scanning in accordance with Control 8.29.
The ISO 27002:2013 Version Explicitly Referred to the Code Re-Use
The 2013 version explicitly stated that the Control 14.2.1 applies to both new developments and to code re-use. In contrast, Control 8.25 did not refer to code re-use scenarios.
New ISO 27002 Controls
New Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
Organisational Controls
People Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
Physical Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
Technological Controls
How ISMS.online Helps
ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.
- Up to 81% progress from when you log in.
- Simple and total compliance solution.
Get in touch today to book a demo.
Jump to topic
