Get started
Annex A 8.29

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

Test security during development and before go-live.

Control
A.8.29
Theme
Technological
Type
Technical control
Status
Selectable via your SoA

Key takeaways

  • Test security during development and before go-live.
  • Testing finds vulnerabilities before attackers do.
  • Start here: define security tests for each release type.

Purpose

Test security during development and before go-live.

Requirement

Requirement summarySecurity testing processes shall be defined and implemented in the development life cycle.

Why it matters

Testing finds vulnerabilities before attackers do.

How to implement

  1. Define security tests for each release type.
  2. Use automated scanning and manual testing where justified.
  3. Fix issues before release or accept risk formally.
  4. Record test results.

What evidence you need to provide

Here is what you will typically need to provide for Annex A 8.29. It does not matter which system it lives in: a document, screenshot or export is fine.

Documents to have ready

  • Your security testing requirements for new releases.
  • Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.29 marked as used or not used, a short reason, and its current status.

Records and examples to show

  • Security test results for recent releases.
  • Acceptance test records.
  • Approvals for any release that went out with known issues.

Things you should be able to show or explain

  • Testers should be able to explain what security testing covers.

How much to show: Two or three releases.

Common mistakes

  • Releases with no security testing.
  • Failed tests overridden without approval.
  • Releasing with known critical issues.
  • No evidence of testing.
  • Tip: Pen test major releases.

Policies & documents to have

  • Secure Development Policy

FAQ

Is A.8.29 mandatory?

Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.

What will I need to show for A.8.29?

Be ready to explain how the control works in your organisation and to provide things like: Your security testing requirements for new releases…

← 8.28 Secure coding8.30 Outsourced development