A.12.5 Security in development and support processes

Objective: To maintain the security of application system software and information.

A.12.5.1 Change control procedures

Control

The implementation of changes shall be controlled by the use of formal change control procedures.

A.12.5.2 Technical review of applications after operating system changes

Control

When operating systems are changed, business critical applications shall be reviewed and tested to ensure there is no adverse impact on organizational operations or security.

A.12.5.3 Restrictions on changes to software packages

Control

Modifications to software packages shall be discouraged, limited to necessary changes, and all changes shall be strictly controlled.

A.12.5.4 Information leakage

Control

Opportunities for information leakage shall be prevented.

A.12.5.5 Outsourced software development

Control

Outsourced software development shall be supervised and monitored by the organization.