10. System Acquisition, Development, and Maintenance

This category ensures that information security is integrated into the organization's systems throughout their lifecycle, including acquisition, development, and maintenance phases. It focuses on secure design principles, protecting application services, and managing vulnerabilities in systems.

Controls (A.14):

• A.14.1.1: Information Security Requirements Analysis and Specification

• A.14.1.2: Securing Application Services on Public Networks

• A.14.1.3: Protecting Application Services Transactions

• A.14.2.1: Secure Development Policy

• A.14.2.2: System Change Control Procedures

• A.14.2.3: Technical Review of Applications after Operating Platform Changes

• A.14.2.4: Restrictions on Changes to Software Packages

• A.14.2.5: Secure System Engineering Principles

• A.14.2.6: Secure Development Environment

• A.14.2.7: Outsourced Development

• A.14.2.8: System Security Testing

• A.14.2.9: System Acceptance Testing

Control A.14.1.1: Information Security Requirements Analysis and Specification

Audit Questions:

• How are information security requirements identified and specified in new systems?

• Are security requirements documented and integrated into the development lifecycle?

Common Non-Conformities (NC):

• Lack of documented security requirements.

• Inadequate integration of security into the development lifecycle.

Control A.14.1.2: Securing Application Services on Public Networks

Audit Questions:

• What measures are in place to secure application services accessible via public networks?

• How is data transmitted over public networks protected?

Common Non-Conformities (NC):

• Insufficient security measures for public-facing applications.

• Inadequate protection for data transmitted over public networks.

Control A.14.1.3: Protecting Application Services Transactions

Audit Questions:

• How are transactions processed by application services protected?

• Are there measures to ensure the integrity and confidentiality of transactions?

Common Non-Conformities (NC):

• Lack of measures to protect application service transactions.

• Transactions vulnerable to integrity or confidentiality breaches.

Control A.14.2.1: Secure Development Policy

Audit Questions:

• Is there a secure development policy in place?

• How is the policy communicated to developers and integrated into development processes?

Common Non-Conformities (NC):

• No secure development policy.

• Poor communication and integration of the policy.

Control A.14.2.2: System Change Control Procedures

Audit Questions:

• Are there procedures for managing changes to systems?

• How are changes evaluated for security impacts before implementation?

Common Non-Conformities (NC):

• No change control procedures.

• Changes implemented without security impact evaluation.

Control A.14.2.3: Technical Review of Applications after Operating Platform Changes

Audit Questions:

• How are applications reviewed after changes to the operating platform?

• Are there procedures to ensure compatibility and security after platform changes?

Common Non-Conformities (NC):

• Applications not reviewed after operating platform changes.

• Lack of procedures to ensure security and compatibility.

Control A.14.2.4: Restrictions on Changes to Software Packages

Audit Questions:

• Are there restrictions on modifying software packages?

• How are unauthorized changes to software packages prevented?

Common Non-Conformities (NC):

• No restrictions on changes to software packages.

• Unauthorized modifications to software packages.

Control A.14.2.5: Secure System Engineering Principles

Audit Questions:

• Are secure engineering principles applied to system design and development?

• How are these principles documented and enforced?

Common Non-Conformities (NC):

• Lack of secure system engineering principles.

• Poor documentation and enforcement of engineering principles.

Control A.14.2.6: Secure Development Environment

Audit Questions:

• How is the development environment secured?

• What measures are in place to protect development resources and data?

Common Non-Conformities (NC):

• Inadequate security measures for the development environment.

• Development resources and data not sufficiently protected.

Control A.14.2.7: Outsourced Development

Audit Questions:

• How is security managed in outsourced development projects?

• Are there agreements to ensure security requirements are met by third parties?

Common Non-Conformities (NC):

• Poor management of security in outsourced development.

• No agreements to ensure third-party compliance with security requirements.

Control A.14.2.8: System Security Testing

Audit Questions:

• Are systems tested for security vulnerabilities?

• How is security testing integrated into the development and maintenance processes?

Common Non-Conformities (NC):

• No security testing for systems.

• Security testing not integrated into development and maintenance.

Control A.14.2.9: System Acceptance Testing

Audit Questions:

• Are systems subjected to acceptance testing before deployment?

• How is security included in acceptance testing criteria?

Common Non-Conformities (NC):

• Lack of acceptance testing for systems.

• Security not included in acceptance testing criteria.