Key takeaways
- Set rules for developing software and systems securely.
- Security designed in from the start is cheaper and stronger than security added later.
- Start here: define a secure development lifecycle.
Purpose
Set rules for developing software and systems securely.
Requirement
Requirement summaryRules for the secure development of software and systems shall be established and applied.
Why it matters
Security designed in from the start is cheaper and stronger than security added later.
How to implement
- Define a secure development lifecycle.
- Include security requirements, design review and testing at each stage.
- Train developers in secure coding.
- Track security issues alongside other defects.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.25. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your secure development policy: how security is built into each stage of building software.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.25 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records showing security steps at each stage, such as design reviews and testing.
- Training records for developers.
- Release checklists that include security.
Things you should be able to show or explain
- Developers should be able to explain how security fits into their work.
How much to show: Two or three recent releases.
Common mistakes
- Security not part of development.
- Developers never trained.
- Security testing only before major releases.
- No developer training.
- Tip: Add security gates to your CI/CD pipeline.
Policies & documents to have
- Secure Development Policy
FAQ
Is A.8.25 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.25?
Be ready to explain how the control works in your organisation and to provide things like: Your secure development policy: how security is built into each stage of building software…