Outsourced development

Plain-language summary

Directing, monitoring and reviewing the work when someone else develops software or systems for you — a web agency, an ERP partner, an app developer, a machine builder — so their output meets your security requirements and you keep control of the code and data.

What the clause is really asking

Organisations that write no code of their own still commission it: the website and customer portal from an agency, ERP customisations and reports from the implementation partner, a mobile app, integrations between systems, PLC and SCADA programming by a machine builder. This control asks you to stay responsible for that work. In practice: put your security requirements and secure development expectations in the contract or statement of work; settle ownership of code and intellectual property; require evidence of the developer's own secure practices and testing; reserve the right to review or audit; plan for continuity if the developer disappears (escrow, or a full copy of source and documentation); control the developer's access to your systems and data; test before acceptance; and check licence obligations in third-party components. Where the developer handles personal information, it is an operator under POPIA sections 20 and 21 and needs a written agreement covering security. So 8.25 and 8.28 may be excluded while this control applies. The common misunderstanding is that outsourcing the work outsources the accountability.

What auditors look for

Auditors ask which systems were developed or customised by third parties, then pick one and pull the contract or statement of work, looking for security requirements, ownership of code and IP, testing obligations and a right to audit. They ask what evidence the supplier gave of secure development and testing, and how you accepted the deliverable. They check how the developer accesses your environment — accounts, MFA, removal after the project — and whether they hold production data. They ask for the POPIA operator agreement where personal information is involved. The hard question: if your web agency closed tomorrow, could someone else maintain your site?

Typical evidence

Register of outsourced development work and suppliers; contracts or statements of work with security, IP, testing and audit clauses; POPIA operator agreements; supplier secure development evidence and test reports; acceptance test records; source code and documentation handover or escrow; developer access records with start and end dates; supplier review records.

How to comply — recommendations

List every system built or customised for you by an outside party, including the website, ERP customisations, integrations and OT programming. Build a one-page set of outsourced development clauses: your security requirements (8.26), secure coding and testing expectations, code and IP ownership, delivery of source and documentation, right to audit, commitments on fixing vulnerabilities, POPIA operator terms, and return or deletion of your data. Use it in every new contract and add it at renewal. Give developers named, time-limited accounts with MFA and no production data unless approved. Accept deliverables only after your own acceptance test. Review key developers annually through your supplier process.

Common nonconformities

No security requirements in development contracts; code ownership and access to source code not settled; no evidence of supplier testing obtained; deliverables accepted without security testing; developers with standing access to production; no POPIA operator agreement where developers handle personal information; no escrow or handover for business-critical systems; outsourced developers missing from supplier reviews.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.