ISO 27001:2022 Annex A 8.28 – Secure Coding Explained

Most application vulnerabilities are not sophisticated.
They are basic coding mistakes repeated at scale.

Annex A 8.28 exists to ensure organisations apply secure coding principles consistently, reducing the likelihood that software introduces vulnerabilities that attackers can exploit.

This control is about how code is written, not just how it is tested.

Quick Guide: Annex A 8.28 at a Glance

Annex A 8.28 of ISO 27001:2022 focuses on secure coding practices.

At a practical level, this means:

Defining secure coding principles and standards
Preventing common and well-known coding weaknesses
Applying secure coding to in-house, outsourced, and open-source software
Ensuring code is reviewed, tested, and maintained securely
Reducing vulnerabilities introduced during development

This is a new control in ISO 27001:2022, reflecting the reality that many security incidents originate directly in application code.

In-Depth Guide to Annex A 8.28

What Is Annex A 8.28 and Why Does It Matter?

Poor coding practices regularly lead to:

Data breaches
Remote code execution
Privilege escalation
Injection attacks
Complete system compromise

These failures are rarely novel. They typically involve:

Missing input validation
Unsafe handling of memory or objects
Weak or hard-coded credentials
Insecure cryptographic implementation
Overly permissive logic

Annex A 8.28 ensures organisations reduce risk at the point vulnerabilities are created, rather than relying solely on testing or perimeter controls to catch them later.

How to Implement Annex A 8.28 Effectively

A pragmatic approach to Annex A 8.28 typically includes the following elements.

1. Define Secure Coding Principles

Organisations should establish approved secure coding principles that apply to:

Internally developed software
Customised applications
Outsourced development
Open-source components

Principles should be:

Documented
Approved
Aligned with organisational risk and technology stack

Secure coding without defined standards becomes inconsistent very quickly.

2. Tailor Secure Coding Standards to Languages and Technologies

Secure coding rules should be adapted for:

Specific programming languages
Frameworks and platforms
Development techniques and patterns

What is secure in one language may be dangerous in another.

3. Identify and Prevent Common Coding Errors

Organisations should identify:

Common historical coding mistakes
Known vulnerability patterns
Frequent causes of previous incidents

Examples include:

Injection flaws
Cross-site scripting
Insecure deserialisation
Poor error handling
Improper authentication logic

Preventing known mistakes is one of the most cost-effective security controls available.

4. Prohibit Inherently Unsafe Coding Practices

Annex A 8.28 explicitly supports preventing insecure practices such as:

Hard-coded passwords or keys
Use of untrusted or unapproved code samples
Unsafe functions or deprecated libraries

Rules should be explicit — not assumed.

5. Apply Secure Coding to Reused and Third-Party Code

Secure coding principles apply equally to:

Reused internal code
Third-party libraries
Open-source components

Organisations should:

Review and approve external components
Track versions and sources
Monitor for vulnerabilities over time

Supply chain risk does not stop at infrastructure.

6. Use Development Tools to Support Secure Coding

Where appropriate, organisations should configure development tools to:

Detect insecure coding patterns
Enforce coding standards
Provide developer guidance

Examples include:

Integrated development environments (IDEs)
Static analysis tools
Secure build pipelines

Tools support secure coding — they do not replace it.

7. Apply Secure Programming Techniques

Annex A 8.28 supports secure programming methods such as:

Structured programming
Defensive coding
Test-driven development
Peer or pair programming

These techniques reduce error rates and improve code quality overall.

8. Document Code and Remove Defects

Secure coding includes:

Clear code documentation
Removal of unused or unsafe code
Correction of identified defects

Unmaintained code quickly becomes insecure code.

9. Perform Security Testing During and After Coding

Secure coding should be supported by testing activities, including:

Code review
Security testing during development
Testing prior to deployment

Testing confirms whether secure coding practices are being applied effectively.

10. Protect Security-Relevant Code

Code performing security functions should be:

Protected from unauthorised access
Segregated where appropriate
Deployed in a way that reduces tampering risk

Security logic exposed to users or attackers is easily bypassed.

11. Apply Secure Update and Maintenance Practices

After deployment, organisations should ensure:

Updates are applied securely
Vulnerabilities are addressed promptly
Changes follow controlled processes

Secure coding is not finished when software goes live.

12. Control Access to Source Code

Source code should be:

Stored in controlled repositories
Accessed only by authorised individuals
Protected from unauthorised modification

This aligns closely with access control and configuration management controls.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.28 does not require:

Developers to be security specialists
Complex tooling everywhere
Elimination of all defects

It does require organisations to:

Avoid repeating known mistakes
Define what secure coding means
Apply it consistently

Most vulnerabilities are avoidable, not inevitable.

Common Challenges and How to Overcome Them

Relying on testing instead of secure coding
Prevent vulnerabilities during coding, not after

Developers unaware of secure coding expectations
Define and enforce secure engineering principles

Uncontrolled use of third-party code
Govern and monitor external components

Security-relevant code exposed or poorly protected
Segregate and protect critical logic

Secure coding failures are usually governance failures.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.28 is about stopping vulnerabilities at source.

When secure coding practices are implemented effectively:

Fewer vulnerabilities reach production
Security testing becomes more effective
Incident likelihood decreases
Confidence in applications improves

Attackers exploit predictable mistakes.
Annex A 8.28 ensures organisations stop making them.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.28 – Secure Coding Explained

Quick Guide: Annex A 8.28 at a Glance

In-Depth Guide to Annex A 8.28

What Is Annex A 8.28 and Why Does It Matter?

How to Implement Annex A 8.28 Effectively

1. Define Secure Coding Principles

2. Tailor Secure Coding Standards to Languages and Technologies

3. Identify and Prevent Common Coding Errors

4. Prohibit Inherently Unsafe Coding Practices

5. Apply Secure Coding to Reused and Third-Party Code

6. Use Development Tools to Support Secure Coding

7. Apply Secure Programming Techniques

8. Document Code and Remove Defects

9. Perform Security Testing During and After Coding

10. Protect Security-Relevant Code

11. Apply Secure Update and Maintenance Practices

12. Control Access to Source Code

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!