What it asks for. This control expects the organisation to direct, monitor and review the activities related to outsourced system development. Its purpose is to make sure the security measures required by the organisation are applied in development work carried out by others.
In practice. Good practice means contractual requirements for secure development, such as coding standards, testing, licensing and intellectual property, along with rights to review or receive evidence. Delivered code is tested before acceptance, and access by the developer to the organisation's environments is controlled. Auditors expect contracts with security requirements, acceptance test results and records of monitoring.
Common gaps. Typical gaps are security requirements missing from development contracts, code accepted without testing and supplier access left active after the project. Requirements on the supplier's own subcontractors and on open source licences are often missing too.