[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-28":3},{"item":4,"lessons":16,"controls":26,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-28","Annex A 8.28","Secure coding",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Secure coding principles should be applied to software development. This applies to software developed internally and, through requirements, to software developed by others for the organisation.\n\n**In practice.** The organisation sets secure coding standards for its languages and frameworks, trains developers on common weaknesses, and builds checks into the pipeline such as static analysis, dependency and secret scanning. Code review includes security considerations, and third party components are tracked and kept up to date. Findings are triaged and fixed within defined timescales. Evidence includes the standards, training records, pipeline configuration, scan results and records of remediation.\n\n**Common gaps.** Scanning tools are often switched on but their findings pile up unresolved. Third party libraries and low code or scripting work done outside the main engineering teams frequently escape the same standards.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"sql-injection-breach-sparks-flawed-gdpr-ruling-on-state-of-the-art-security","SQL Injection Breach Sparks Flawed GDPR Ruling on 'State of the Art' Security","2026-07-16T12:20:40.65+00:00",{"slug":23,"title":24,"published_at":25},"ai-accelerated-development-outpaces-security-controls","AI-Accelerated Development Outpaces Security Controls","2026-07-06T16:21:14.007+00:00",[27,32],{"slug":28,"name":29,"problem":30,"stories":31},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",1,{"slug":33,"name":34,"problem":35,"stories":31},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[37,42,47,51,56,60,64,68],{"family":38,"item":39,"code":40,"title":41,"together":9},"cis","16","Control 16","Application Software Security",{"family":43,"item":44,"code":45,"title":46,"together":9},"nist-800-53","sa-11","SA-11","Developer Testing and Evaluation",{"family":38,"item":48,"code":49,"title":50,"together":31},"7","Control 7","Continuous Vulnerability Management",{"family":52,"item":53,"code":54,"title":55,"together":31},"gdpr","32","Article 32","Security of processing",{"family":52,"item":57,"code":58,"title":59,"together":31},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":52,"item":61,"code":62,"title":63,"together":31},"83","Article 83","General conditions for imposing administrative fines",{"family":65,"item":66,"code":67,"title":67,"together":31},"itil","overview","ITIL",{"family":69,"item":70,"code":71,"title":72,"together":31},"owasp","top10-2021-a03","A03:2021","A03:2021 Injection"]