--- title: "ISO 27001: 2022 A.8.28 Secure coding" description: "This article provides additional information on how you can meet the requirement for the ISO 27001: 2022 control A.8.28 Secure coding." --- [Skip to content](https://knowledge.adoptech.co.uk/a.8.28-secure-coding#main-content) [![Adoptech-logo-GreyWithoutStrapline-1.png\]](https://knowledge.adoptech.co.uk/hs-fs/hubfs/Adoptech-logo-GreyWithoutStrapline-1.png?height=39&name=Adoptech-logo-GreyWithoutStrapline-1.png)](https://knowledge.adoptech.co.uk/?hsLang=en) Open main navigation Close main navigation Adoptech Help Centre - There are no suggestions because the search field is empty. 1. [Knowledge base](https://knowledge.adoptech.co.uk/?hsLang=en) 2. [Frameworks & Certifications](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en) 3. [ISO 27001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-27001) # ISO 27001: 2022 A.8.28 Secure coding ## This article provides additional information on how you can meet the requirement for the ISO 27001: 2022 control A.8.28 Secure coding. ### **ISO 27001: 2022 Control Description** Secure coding principles shall be applied to software development. ### **Purpose ** To ensure that software is written securely, reducing the risk of information security vulnerabilities. ### **Guidance on implementation** #### Establishing Secure Coding Practices Organisations should develop comprehensive processes to govern secure coding across all development activities. This includes setting a minimum security baseline that applies to both internally developed software and third-party or open-source components. Staying informed about current threats and vulnerabilities is crucial for continually improving secure coding practices to address the rapidly evolving threat landscape. #### Planning and Preparation Secure coding principles should be applied to all software development, whether creating new software or reusing existing code. This applies to both in-house and outsourced projects. Before coding begins, consider the following: - Organisation-Specific Secure Coding Expectations: Define and communicate secure coding standards for all development projects. - Common Security Vulnerabilities: Be aware of common coding practices that lead to security vulnerabilities. - Development Tools Configuration: Configure development tools, like Integrated Development Environments (IDEs), to support secure coding. - Guidance from Tool Providers: Follow the security guidelines provided by the creators of development tools and platforms. - Updated Tools: Ensure that development tools, such as compilers, are up-to-date. - Developer Training: Ensure developers are qualified in secure coding practices. - Secure Design and Architecture: Incorporate security from the design phase, including threat modelling. - Secure Coding Standards: Implement and mandate secure coding standards as applicable. - Controlled Development Environments: Use secure, controlled environments for development. #### During Coding While coding, keep the following in mind: - Language-Specific Secure Practices: Apply secure coding practices tailored to the programming languages in use. - Secure Programming Techniques: Use techniques like pair programming, refactoring, peer reviews, security iterations, and test-driven development. - Structured Programming: Follow structured programming techniques to enhance security. - Code Documentation and Defect Removal: Document the code thoroughly and eliminate defects that could lead to security vulnerabilities. - Avoid Insecure Design: Prohibit the use of insecure design methods, such as hard-coded passwords and unauthenticated web services. Security testing should be performed throughout development, including static application security testing (SAST) to identify vulnerabilities. #### Before making software operational, evaluate: - Attack Surface and Least Privilege: Minimise the attack surface and apply the principle of least privilege. - Common Programming Errors: Analyse and mitigate common programming errors. #### Review and Maintenance After the software is deployed: - Secure Updates: Ensure that updates are securely packaged and deployed. - Vulnerability Management: Address reported security vulnerabilities promptly. - Logging and Monitoring: Log errors and suspected attacks, regularly reviewing these logs to improve code security. - Source Code Protection: Protect source code from unauthorised access and tampering using tools like configuration management systems with access and version control features. #### External Tools and Libraries When using external libraries or tools, consider the following: - Library Management: Maintain an inventory of libraries and ensure they are regularly updated. - Component Selection: Choose well-vetted components, particularly for authentication and cryptographic purposes. - Licence and Security History: Verify the licence, security, and history of external components. - Long-Term Maintainability: Ensure that software is maintainable, tracked, and from reputable sources. - Development Resources Availability: Ensure long-term availability of development resources and artefacts. #### Modifying Software Packages If a software package needs modification: - Risk of Compromised Controls: Assess the risk of compromising built-in controls and integrity processes. - Vendor Consent: Consider whether to obtain the vendor’s consent for modifications. - Vendor Updates: Check if the required changes can be obtained through standard vendor updates. - Future Maintenance Impact: Evaluate the impact of taking on future maintenance responsibilities. - Compatibility: Ensure compatibility with other software in use. ### Additional Information - Security-Related Code: Ensure that security-relevant code is always invoked when needed and is tamper-resistant. - Compiled vs Interpreted Code: For interpreted languages, consider running code on a secure server where access is tightly controlled. Use security mechanisms like just-in-time administration and strong authentication to protect administrator access. - Assume Vulnerability: Design application code with the assumption that it could be subject to attack, and build in checks to ensure that output remains within safe boundaries, especially in critical applications. - Web Application Security: Be aware of vulnerabilities specific to web applications, such as SQL injection and cross-site scripting, and design to mitigate these risks. - [Getting Started](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#main-content) - [Getting Started](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#getting-started) - [Accounts & Billing](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#accounts-billing) - [FAQ's on Adoptech](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#main-content) - [Frameworks](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#frameworks) - [Policies & Documents](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#policies-documents) - [Risk Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#risk-management) - [Supplier Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#supplier-management) - [Audit Preparation](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#audit-preparation) - [Trust Centre](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#trust-centre) - [User Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#user-management) - [Frameworks & Certifications](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#main-content) - [ISO 27001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-27001) - [ISO 42001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-42001) - [Cyber Essentials](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#cyber-essentials) - [CAF](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#caf) - [PCI-DSS](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#pci-dss) - [SOC2](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#soc2) - [Data Privacy (GDPR)](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#data-privacy-gdpr) - [DORA](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#dora) - [ISO 9001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-9001) - [ISO 22301](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-22301) - [ISO 14001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-14001) - [NIST 800-53](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nist-800-53) - [NIST-CSF](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nist-csf) - [NIS2](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nis2) - [ISO 20000-1](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-20000-1) - [HIPAA](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#hipaa) - [Integrations](https://knowledge.adoptech.co.uk/integrations?hsLang=en#main-content) - [Cloud Infrastructure](https://knowledge.adoptech.co.uk/integrations?hsLang=en#cloud-infrastructure) - [Identity & Access](https://knowledge.adoptech.co.uk/integrations?hsLang=en#identity-access) - [DevOps & Code](https://knowledge.adoptech.co.uk/integrations?hsLang=en#devops-code) - [Project Management](https://knowledge.adoptech.co.uk/integrations?hsLang=en#project-management) - [HR & People Systems](https://knowledge.adoptech.co.uk/integrations?hsLang=en#hr-people-systems) - [Security & Devices](https://knowledge.adoptech.co.uk/integrations?hsLang=en#security-devices) - [Communication & Collaboration](https://knowledge.adoptech.co.uk/integrations?hsLang=en#communication-collaboration) - [Legal & Regulations](https://knowledge.adoptech.co.uk/legal-regulations?hsLang=en) - [Security Guidance](https://knowledge.adoptech.co.uk/security-guidance?hsLang=en) - [Troubleshooting](https://knowledge.adoptech.co.uk/troubleshooting?hsLang=en) [![Chill listening crop-3](https://knowledge.adoptech.co.uk/hs-fs/hubfs/adoptech-logo-1.png?width=209&height=54&name=adoptech-logo-1.png "Chill listening crop-3")](https://adoptech.co.uk/) Copyright © 2026, Adoptech Ltd.