The controls, and the evidence for each
ControlWhat it coversEvidence EmberNest records
8.25 Secure development life cycleRules for developing software securely
8.26 Application security requirementsSecurity requirements defined and approved
8.27 Secure system architecture and engineering principlesArchitecture principles applied
8.28 Secure codingSecure coding principles applied
8.29 Security testing in development and acceptanceTesting before release
8.30 Outsourced developmentControls over suppliers' development
8.31 Separation of development, test and production environmentsEnvironments kept apart
8.32 Change managementChanges controlled and approved
What auditors ask about AI-assisted changes
- Which changes were written or suggested by AI?
- Who approved each one, and were the author and the approver different people?
- What tested it before it reached production?
- Which models and tools were used, and under what rules?
Expect questions like these, and keep the answer next to the change rather than rebuilding it later.
How to start
Start by finding out where you stand. A free assurance report gives you a grade, a map of your codebase and your level on the assurance ladder. EmberNest helps you evidence these controls. Certification is awarded to an organisation by a certification body, so EmberNest does not make you certified.
This page is not legal advice.
All standards