ISO/IEC 27001:2022 Annex A · Control 8.28

Secure Coding: A Practical Implementation Guide

Give developers practical rules and feedback that prevent common software weaknesses.

This control concerns applying secure coding principles to software development.

Practical interpretation: A secure coding standard should fit languages and frameworks, be reinforced through review and tooling, and connect findings to developer learning.

What should the control achieve?

Coding rules address relevant technologies and threats.
Developers receive role-appropriate guidance.
Reviews and automated checks detect violations.
Exceptions and recurring defects are managed.

Step-by-step implementation

Define language-specific rules

Cover validation, output encoding, authorization, secrets, errors, logging, cryptography and unsafe functions.

Train with examples

Use the organization’s frameworks and real defect patterns.

Make secure patterns easy

Provide libraries, templates and reference implementations.

Review changes

Use peer review and specialist review for sensitive code.

Automate checks

Apply SAST, secret scanning, linting and dependency analysis.

Learn from defects

Track root causes and update standards and training.

What this could look like in practice

Developers use a secure service template with approved authentication and logging. Pull requests run secret and static analysis; critical findings block merge, and false-positive suppressions require review and expiry.

Activity	Practical implementation	Evidence
Coding standard	Language-specific guidance covers common weaknesses.	Standard
Pull request	Reviewer checks security-sensitive changes.	Review record
Automated scan	Pipeline blocks high-confidence critical finding.	Scan report
Exception	Suppression has rationale and owner.	Exception record

Implementation evidence

Secure coding standard
Developer training
Approved libraries
Code reviews
Scan configuration
Finding records
Suppression register
Defect trends

Useful metrics

Developers trained
Critical findings before merge
Repeated defect classes
Suppressions past expiry

Common mistakes

Publishing generic OWASP links without local guidance.
Relying only on scanners.
Copying secrets into code.
Rewarding delivery speed over defect correction.
Permanent scan suppressions.

Questions an auditor may ask

Which coding rules apply by technology?
How are developers trained?
Show a blocked defect.
How are repeated weaknesses addressed?

Implementation test: Review a security-sensitive code change and verify standard, peer review, automated checks, exception handling and evidence.

Continue through Annex A

Explore the growing library of practical guides for all 93 Annex A controls.

Open the ISO 27001 Annex A Control Library

This independent educational guide paraphrases the practical intent of the control and does not replace the official ISO standards, professional advice or an organization-specific risk assessment. It is not affiliated with or endorsed by ISO.

ISO 27001 Annex A 8.28: Secure Coding – Practical Implementation Guide