OWASP Top 10:2025
Integrity

OWASP Top 10:2025 8: A08:2025 Software and Data Integrity Failures

Address OWASP Top 10 A08 Software and Data Integrity Failures per OWASP Top 10:2025. Software and Data Integrity Failures arise from assumptions about software updates + critical data + CI/CD pipelines without verifying integrity including unsigned updates + insecure deserialisation + third-party script + tag injection + plugin compromise + supply chain attacks. Mitigations include (a) implement code signing + signature verification for software updates + plugins + (b) implement secure CI/CD pipeline including signed artefacts + isolated build environments + integrity verification + (c) implement Subresource Integrity (SRI) for third-party scripts + (d) implement secure deserialisation including allow-list of accepted types + (e) implement third-party script + tag management with monitoring + (f) protect against supply chain attacks via dependency confusion + typosquatting + repository compromise.

What else in your programme already covers this

This control maps to 11 controls across 8 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 30111:2019 · 2 controls

  • CWE-502 Deserialization of Untrusted Data

IEEE 1686 · 1 control

ISO/IEC 27400:2022 · 1 control

  • NIS2I-7 Network Security, Logging, Monitoring, and Vulnerability Handling
  • NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection
  • NZISM-5 Network Security, System Hardening, and Application Security

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 11 it maps to, and the evidence behind each claim, over MCP and REST.