What it asks for. This control expects rules for the secure development of software and systems to be established and applied. Its purpose is to make sure information security is designed and implemented within the development life cycle.
In practice. Good practice means building security into each stage of development: security requirements, secure design, secure coding guidance, separate environments, testing, protection of source code and version control. Developers receive relevant training. Auditors look for a documented secure development policy, evidence of security activities in projects such as reviews and tests, and pipeline controls.
Common gaps. Common gaps are policies that development teams do not know, security testing skipped under deadline pressure and low-code or automation projects outside the process. Third-party and open source components are often not covered by the rules.