What it asks for. This control expects security testing processes to be defined and implemented in the development life cycle. Its purpose is to validate that security requirements are met when applications or code are deployed to production.
In practice. Good practice means planning security tests against the security requirements, using methods such as static and dynamic analysis, dependency scanning, code review and penetration testing, and including security in acceptance criteria before release. Tests apply to in-house and outsourced development. Auditors expect test plans, results, records of fixes and acceptance decisions.
Common gaps. Typical gaps are testing only before major releases, findings accepted without risk decisions and acquired products accepted without any security testing. Test environments that use real personal data without protection are another frequent problem, and results are not shared with developers.