All 93 controls · Technological controls
Control 8.30
Outsourced development
What ISO/IEC 27002:2022 control 8.30 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
When another party develops systems for the organization, the organization is to steer that work, watch it and review it. Purpose: make sure the security measures the organization requires are actually applied in development done by others. Guidance: communicate and agree requirements and expectations with the developer and keep monitoring and reviewing whether the delivered work meets them. Across the whole external supply chain, consider licensing, code ownership and intellectual property in the outsourced work (5.32); contract terms requiring secure design, coding and testing practices (8.25 to 8.29); giving external developers the threat model to work to; acceptance testing of the quality and accuracy of deliverables (8.29); evidence, such as assurance reports, that minimum security and privacy capabilities are in place; evidence that testing on delivery was enough to guard against malicious content, deliberate or accidental; evidence that testing was enough to guard against known vulnerabilities; source code escrow in case, for example, the supplier fails; a contract right to audit how the supplier develops and what controls it runs; security requirements for the development environment (8.31); and applicable law, such as personal data protection. Other information: the ISO/IEC 27036 series covers supplier relationships further.
Purpose in the standard’s terms, in our words: Ensures the organization's required security measures are implemented in outsourced system development.
Attribute values in one line: Preventive, Detective; Confidentiality, Integrity, Availability; Identify, Protect, Detect; System and network security, Application security, Supplier relationships security; Governance and ecosystem, Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | PreventiveDetective |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | IdentifyProtectDetect |
| Operational capabilities | System and network securityApplication securitySupplier relationships security |
| Security domains | Governance and ecosystemProtection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Development contracts covering intellectual property, secure design, coding and testing obligations, right to audit, development environment security and legal compliance
- The threat model or security requirements provided to the external developer
- Acceptance test records for delivered software, including checks for malicious content and known vulnerabilities
- Supplier assurance reports demonstrating minimum security and privacy capabilities
- Source code escrow agreements for critical software
- Monitoring and review records of the supplier's delivery against agreed expectations
Where audits commonly find gaps
- Contracts focus on functionality and deadlines with no secure development obligations
- Delivered code is accepted without any security testing
- No escrow exists for critical software from small suppliers
- Sub-contracted developers further down the chain are unknown and unmanaged
What ISO/IEC 27028 changes for this control
It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. It crosses 3 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (14.2.7) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.