A.8.29 Security testing in development and acceptance | ISO 27001 Control

Purpose

To identify and address security vulnerabilities before production deployment.

Implementation Guidance

Include security testing in all development phases

Perform static and dynamic security testing

Conduct penetration testing for critical applications

Test security controls and configurations

Address security issues before production release

Recommended Tools

Snyk

Developer-first security platform for finding and fixing vulnerabilities in code, dependencies, and containers.

Semgrep

Fast, open-source static analysis tool. Best free SAST option for startups.

OWASP ZAP

Leading open-source web application security scanner. Essential for dynamic testing.

GitHub

Leading platform for version control and code collaboration. Essential for software development teams.

ISO 27001 Services from the Directory

These providers can help you implement A.8.29 and achieve ISO 27001 certification.

Advisera

Provider of ISO 27001 documentation, training, and consultancy services to help businesses achieve compliance.

Anecdotes

Enterprise agentic GRC platform with 230+ integrations and 40+ pre-mapped frameworks for Fortune 500 compliance programs.

Arrow Cyber Advisors

Arrow Cyber Advisors enables organizations to build measurable cybersecurity maturity and resilience. We specialize in governance, risk and compliance advisory, providing clear security direction, maturity benchmarking, and execution support tailored to regulated and high-risk environments.