Get started
Annex A 8.30

ISO 27001 Annex A 8.30 Outsourced Development

Direct, monitor and review outsourced development work.

Control
A.8.30
Theme
Technological
Type
Administrative control
Status
Selectable via your SoA

Key takeaways

  • Direct, monitor and review outsourced development work.
  • Outsourced development still needs your security standards.
  • Start here: set security requirements in development contracts.

Purpose

Direct, monitor and review outsourced development work.

Requirement

Requirement summaryThe organization shall direct, monitor and review the activities related to outsourced system development.

Why it matters

Outsourced development still needs your security standards.

How to implement

  1. Set security requirements in development contracts.
  2. Review the supplier's development practices.
  3. Test delivered code before acceptance.
  4. Retain rights to audit and access code.

What evidence you need to provide

Here is what you will typically need to provide for Annex A 8.30. It does not matter which system it lives in: a document, screenshot or export is fine.

Documents to have ready

  • Your requirements for outsourced (third-party) software development.
  • Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.30 marked as used or not used, a short reason, and its current status.

Records and examples to show

  • Contracts with external developers including security terms.
  • Records of how their work was supervised.
  • Test results for code they delivered.

Things you should be able to show or explain

  • Be able to explain how outsourced work is checked.

How much to show: Any outsourced projects.

Common mistakes

  • No supervision.
  • No security terms in the contract.
  • Accepting code without review.
  • No security terms in development contracts.
  • Tip: Contractually require secure coding and code access.

Policies & documents to have

  • Secure Development Policy
  • Third-Party Management Policy

FAQ

Is A.8.30 mandatory?

Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.

What will I need to show for A.8.30?

Be ready to explain how the control works in your organisation and to provide things like: Your requirements for outsourced (third-party) software development…

← 8.29 Security testing in development and acceptance8.31 Separation of development, test and production environments