8.29 Security testing in development and acceptance
Requires security testing processes to be defined and implemented within the development life cycle.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Test results for the period, covering the techniques used such as static analysis, dynamic testing, dependency scanning and penetration testing · Vulnerability scanner / patch tooling
- Evidence testing occurs in the development lifecycle and again at acceptance, rather than only before a major release · Source control / CI pipeline
- Records of findings, their severity, remediation and retest evidence · Document repository
- Evidence of the independence and competence of testers where the testing is meant to be independent · HR system / LMS
governing documentDocuments that govern the control
- The security testing process defining what testing is performed at which stage, and the acceptance criteria · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Testing performed once a year against a production system, with everything released between times untested
- Findings recorded with no retest, so remediation is assumed rather than confirmed
- Acceptance criteria absent, so a release proceeds with open high severity findings and no decision record
- Test scope excludes the components most likely to be attacked, such as application programming interfaces and administrative interfaces
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet