The ISO 27001 Question Your Certificate Can’t Answer

ISO 27001:2022 made secure development an active audit obligation. Most enterprises still can't map the apps they actually built to Annex A.

Picture a surveillance audit. The certificate is current. The Statement of Applicability is signed. Then the auditor asks one simple question: how do your secure development controls apply to each application you built?

Silence. Because the honest answer includes the HR workflow a business unit built last spring, the ERP customization nobody logged and the AI-generated tool that went live in a week.

The 2022 revision closed a loophole

Under the 2013 version, organizations could acknowledge application security controls without explaining how they applied to internal builds. ISO 27001:2022 removed that flexibility. Controls A.8.25 to A.8.29 now expect a documented secure development lifecycle, security requirements before build, secure architecture, secure coding and testing before production. The transition deadline passed in October 2025.

Where auditors find the gap

Most SDLC policies cover the central development team. They rarely cover business-unit tools, HCM customizations or AI-assisted builds. The full article explains what evidence each control expects and why the business-side app owner is so often the missing piece.

Read the full article on CloudApper: ISO 27001:2022 Application Security Controls: What Enterprise IT Actually Owes the Auditor