8.30 Outsourced development
Requires the organisation to direct, monitor and review the activities involved in outsourced system development. Secondary commentary notes that explicit direction and review were added in the 2022 revision in response
5
artefacts
0
held by a system
4
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Contractual security requirements imposed on the development supplier, covering secure development practice, testing, code ownership and the right to review · Source control / CI pipeline
- Evidence of monitoring during delivery, including progress and security reviews rather than acceptance testing alone · SIEM / log platform
- Review evidence of the delivered code and its components, including independent testing · Vendor register / contract repository
- Records of the handling of intellectual property, escrow and access to the code after delivery · Vendor register / contract repository
governing documentDocuments that govern the control
- Evidence of direction given, such as agreed standards, architecture constraints and acceptance criteria · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Requirements set in the contract with no monitoring during delivery, so the first check is at acceptance
- Supplier assurance accepted as their own test results with nothing independent
- Code delivered as a binary with no visibility of components or practice
- Subcontracted development by the supplier not disclosed or covered by any equivalent requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.29 Security testing in development and acceptance · 8.31 Separation of development, test and production environments