## 8.30 Outsourced development

| Control type           | Information security properties              | Cybersecurity concepts        | Operational capabilities                                                            | Security domains                      |
| :--------------------- | :------------------------------------------- | :---------------------------- | :---------------------------------------------------------------------------------- | :------------------------------------ |
| #Preventive #Detective | #Confidentiality<br>#Integrity #Availability | #Identify #Protect<br>#Detect | #System_and_network_security #Application_security #Supplier_relationships_security | #Governance_and_Ecosystem #Protection |

**Control**
The organization should direct, monitor and review the activities related to outsourced system development.

**Purpose**
To ensure information security measures required by the organization are implemented in outsourced system development.

**Guidance**
Where system development is outsourced, the organization should communicate and agree requirements and expectations, and continually monitor and review whether the delivery of outsourced work meets these expectations. The following points should be considered across the organization’s entire external supply chain:

a\) licensing agreements, code ownership and intellectual property rights related to the outsourced content (see [5.32](a-5.32-Intellectual-property-rights.md));

b\) contractual requirements for secure design, coding and testing practices (see  8.25 to  8.29 );

c\) provision of the threat model to consider by external developers;

d\) acceptance testing for the quality and accuracy of the deliverables (see [8.29](a-8.29-Security-testing-in-development-and-acceptance.md));

e\) provision of evidence that minimum acceptable levels of security and privacy capabilities are established (e.g. assurance reports);

f\) provision of evidence that sufficient testing has been applied to guard against the presence of malicious content (both intentional and unintentional) upon delivery;

g\) provision of evidence that sufficient testing has been applied to guard against the presence of known vulnerabilities;

h\) escrow agreements for the software source code (e.g. if the supplier goes out of business);

i\) contractual right to audit development processes and controls;

j\) security requirements for the development environment (see [8.31](a-8.31-Separation-of-development-test-and-production-environments.md));

k\) taking consideration of applicable legislation (e.g. on protection of personal data).

**Other information**
Further information on supplier relationships can be found in the ISO/IEC 27036 series.