[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-25":3},{"item":4,"lessons":16,"controls":30,"related":57},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-25","Annex A 8.25","ISO\u002FIEC 27001:2022 Annex A 8.25: Secure development life cycle",3,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects rules for the secure development of software and systems to be established and applied. Its purpose is to make sure information security is designed and implemented within the development life cycle.\n\n**In practice.** Good practice means building security into each stage of development: security requirements, secure design, secure coding guidance, separate environments, testing, protection of source code and version control. Developers receive relevant training. Auditors look for a documented secure development policy, evidence of security activities in projects such as reviews and tests, and pipeline controls.\n\n**Common gaps.** Common gaps are policies that development teams do not know, security testing skipped under deadline pressure and low-code or automation projects outside the process. Third-party and open source components are often not covered by the rules.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26],{"slug":19,"title":20,"published_at":21},"healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft-via-tracking-pixels","Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft via Tracking Pixels","2026-10-14T08:20:59.917+00:00",{"slug":23,"title":24,"published_at":25},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","2026-10-12T14:21:55.533+00:00",{"slug":27,"title":28,"published_at":29},"orange-romania-fined-100k-for-gdpr-failures-in-data-protection-and-security-controls","Orange Romania Fined €100K for GDPR Failures in Data Protection and Security Controls","2026-07-22T10:21:04.18+00:00",[31,36,40,44,49,53],{"slug":32,"name":33,"problem":34,"stories":35},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":37,"name":38,"problem":39,"stories":35},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":41,"name":42,"problem":43,"stories":35},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":45,"name":46,"problem":47,"stories":48},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":50,"name":51,"problem":52,"stories":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56,"stories":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,63,67,72,76,80,85,89],{"family":59,"item":60,"code":61,"title":62,"together":9},"gdpr","25","Article 25","Data protection by design and by default",{"family":59,"item":64,"code":65,"title":66,"together":9},"32","Article 32","Security of processing",{"family":68,"item":69,"code":70,"title":71,"together":35},"cis","3","Control 3","Data Protection",{"family":73,"item":74,"code":75,"title":75,"together":35},"itil","overview","ITIL",{"family":59,"item":77,"code":78,"title":79,"together":35},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":81,"item":82,"code":83,"title":84,"together":35},"nist-800-53","sa-9","SA-9","External System Services",{"family":68,"item":86,"code":87,"title":88,"together":35},"16","Control 16","Application Software Security",{"family":81,"item":90,"code":91,"title":92,"together":35},"si-12","SI-12","Information Management and Retention"]