[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-30":3},{"item":4,"lessons":16,"controls":38,"related":66},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-30","Annex A 8.30","ISO\u002FIEC 27001:2022 Annex A 8.30: Outsourced development",5,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to direct, monitor and review the activities related to outsourced system development. Its purpose is to make sure the security measures required by the organisation are applied in development work carried out by others.\n\n**In practice.** Good practice means contractual requirements for secure development, such as coding standards, testing, licensing and intellectual property, along with rights to review or receive evidence. Delivered code is tested before acceptance, and access by the developer to the organisation's environments is controlled. Auditors expect contracts with security requirements, acceptance test results and records of monitoring.\n\n**Common gaps.** Typical gaps are security requirements missing from development contracts, code accepted without testing and supplier access left active after the project. Requirements on the supplier's own subcontractors and on open source licences are often missing too.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"needymantis-malware-exploits-daemon-tools-supply-chain-compromise","NeedyMantis Malware Exploits Daemon Tools Supply Chain Compromise","2026-09-29T10:20:21.606+00:00",{"slug":23,"title":24,"published_at":25},"malicious-npm-package-hides-loader-in-runtime-code-earns-230k","Malicious npm Package Hides Loader in Runtime Code, Earns €230K","2026-09-22T13:21:42.265+00:00",{"slug":27,"title":28,"published_at":29},"malicious-packagist-packages-exploit-unpatched-ios-webkit-to-steal-crypto-seeds","Malicious Packagist Packages Exploit Unpatched iOS WebKit to Steal Crypto Seeds","2026-09-01T16:21:17.14+00:00",{"slug":31,"title":32,"published_at":33},"teampcp-supply-chain-attacks-compromise-1000-orgs-via-open-source-platforms","TeamPCP Supply-Chain Attacks Compromise 1,000+ Orgs via Open-Source Platforms","2026-08-27T14:20:21.279+00:00",{"slug":35,"title":36,"published_at":37},"shapedplugin-wordpress-pro-plugins-backdoored-via-compromised-build-pipeline","ShapedPlugin WordPress Pro Plugins Backdoored via Compromised Build Pipeline","2026-06-22T20:21:28.335+00:00",[39,43,48,52,57,62],{"slug":40,"name":41,"problem":42,"stories":9},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":44,"name":45,"problem":46,"stories":47},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,{"slug":49,"name":50,"problem":51,"stories":47},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55,"stories":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":58,"name":59,"problem":60,"stories":61},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":63,"name":64,"problem":65,"stories":61},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[67,72,77,83,87,91,95,100],{"family":68,"item":69,"code":70,"title":71,"together":9},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":73,"item":74,"code":75,"title":76,"together":9},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":78,"item":79,"code":80,"title":81,"together":82},"gdpr","32","Article 32","Security of processing",4,{"family":68,"item":84,"code":85,"title":86,"together":82},"7","Control 7","Continuous Vulnerability Management",{"family":68,"item":88,"code":89,"title":90,"together":47},"16","Control 16","Application Software Security",{"family":73,"item":92,"code":93,"title":94,"together":47},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",{"family":96,"item":97,"code":98,"title":99,"together":47},"nist-800-53","sa-12","SA-12","Supply Chain Protection",{"family":101,"item":102,"code":103,"title":104,"together":47},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)"]