When another party develops systems for the organization, the organization is to steer that work, watch it and review it. Purpose: make sure the security measures the organization requires are actually applied in development done by others. Guidance: communicate and agree requirements and expectations with the developer and keep monitoring and reviewing whether the delivered work meets them. Across the whole external supply chain, consider licensing, code ownership and intellectual property in the outsourced work (5.32); contract terms requiring secure design, coding and testing practices (8.25 to 8.29); giving external developers the threat model to work to; acceptance testing of the quality and accuracy of deliverables (8.29); evidence, such as assurance reports, that minimum security and privacy capabilities are in place; evidence that testing on delivery was enough to guard against malicious content, deliberate or accidental; evidence that testing was enough to guard against known vulnerabilities; source code escrow in case, for example, the supplier fails; a contract right to audit how the supplier develops and what controls it runs; security requirements for the development environment (8.31); and applicable law, such as personal data protection. Other information: the ISO/IEC 27036 series covers supplier relationships further.
This control maps to 47 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 8.30 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.