ISO 27001 A.8.25: secure development, explained for startups
What A.8.25 asks of a small company, and what an auditor samples.
Build security into every stage of how you develop software, from design to release. Treat secure development as a standard part of shipping.
Why it exists: to build security into every step of making its software.
A.8.25 Secure development life cycle
Security is part of every step of building software. What proves it: a written secure development process, and evidence that the team follows it.
A certification auditor samples the secure development procedure. A file that usually does the job: your secure development policy and a merged pull request showing review and checks.
How to put it in place
Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.8.25 walks you through it in this order.
- Write down the security steps: design review, code review, scanning and testing.
- Approve them in the secure development policy.
- Make the checks part of your pipeline.
The free ISO 27001 readiness assessment asks one question that evidences it:
- How do code changes reach production?
Policies, connectors and the SOC 2 overlap
In the ISO 27001 policy pack, the Secure Development and Change Management Policy covers A.8.25. An auditor reads the policy for the rule, then samples the records to see the rule was followed.
The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC8.1, change management.
Technological controls
A.8.25 is one of the 34 technological controls in Annex A. The controls built into your systems: access, devices, malware, vulnerabilities, backups, logging, networks, encryption and secure development. Exports and settings screenshots prove most of them.
Nearby controls in the same theme:
- A.8.22, network segregation
- A.8.23, web filtering
- A.8.24, encryption
- A.8.26, application security needs
- A.8.27, secure architecture
- A.8.28, secure coding
Before it: A.8.24, encryption. After it: A.8.26, application security needs. Every control, by theme, is on the Annex A controls page.
Questions
What does ISO 27001 A.8.25 require?
What evidence does an auditor want for A.8.25?
Get ready for ISO 27001 certification.
The readiness assessment is free, with no payment and no card. ISO 27001 is part of Constellation, at $10,800 a year: everything in Orbit plus the management system, the policies, the evidence and the management review for ISO 27001, and your SOC 2 Type 2 audit is included in every contract year. You contract the certification body directly.
The internal audit is priced separately: Polara arranges it with an independent internal auditor from our partner network who works in the platform, and quotes it for your company.
Take the free assessmentPolara Labs is not a certification body. Certification audits are performed by independent accredited certification bodies.