ASD ISM 1239 Ensure use of robust web application frameworks
What it says
Robust web application frameworks are used in the development of web applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDevelop web apps using strong frameworks to enhance security.
Using a strong web application framework to develop your website is like building a house with a solid foundation. It helps keep your site secure from hackers who might try to break in and steal data or cause other issues. Without it, you risk facing data breaches, financial losses, or damage to your business reputation.
Free. Save your status, tasks and notes.
Why it matters
Neglecting robust web frameworks invites common web flaws, risking customer data exposure and harming the organisation's reputation.
How to implement
Web development team should select a reputable web application framework: Choose a framework known for its robust security features, such as Django or Ruby on Rails.
Research and compare their security capabilities and community support to make an informed choice.
IT team should configure the framework's security settings: Follow the framework's security guidelines to properly set up secure defaults.
This includes settings for password protection, data encryption, and access controls.
Project manager should document the framework choice: Record why the specific framework was chosen, highlighting its security benefits.
This document should be reviewed and approved by the relevant stakeholders.
Web development team should integrate security updates: Regularly apply updates and patches provided by the framework's developers.
Set up alerts or a process for monitoring when updates are released.
System owner should provide training on secure coding practices: Ensure all developers understand and follow best practices for secure coding using the selected framework.
Organise workshops or training sessions with practical examples.
Keep it running
Standardise on vetted web frameworks, keep them patched, and remove unsupported versions to reduce common web application vulnerabilities.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The framework selection document: Request the document explaining why the chosen web application framework was selected.
Look at
The reasons provided and check for mentions of security features.
Good evidence
Includes clear evidence of security considerations as part of the decision.
- Check 2 of 5What an auditor asks for
Ask for
To see the framework configuration: Request to review the current configuration settings of the web application framework.
Look at
The specific settings related to security and access controls.
Good evidence
Is showing that security settings are aligned with the recommended guidelines.
- Check 3 of 5What an auditor asks for
Ask for
Update logs: Request records of updates and patches applied to the web application framework.
Look at
The dates and types of updates applied.
Good evidence
Shows that updates are applied regularly and in a timely manner.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request evidence of training sessions or materials provided to developers.
Look at
Topics covering secure coding practices specific to the framework.
Good evidence
Includes regular training sessions with attendance logs or training materials.
- Check 5 of 5What an auditor asks for
Ask for
Penetration testing reports: Request any reports from security tests conducted on the web application.
Look at
The findings and how they were addressed.
Good evidence
Includes recent test results with documented fixes for any issues found.
Mappings
Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.25.
ISM-1239 requires robust web application frameworks to be used for web application development. Annex A 8.25 establishes and applies rules for a secure development lifecycle, within which selecting approved/robust frameworks is a common mandated rule. Annex A 8.25 is broader, covering governance and practices across the SDLC beyond the specific design choice of a web framework.
This control partially meets A.8.28.
Annex A 8.28 requires secure coding principles to be applied to prevent vulnerabilities. ISM-1239 supports this by mandating the use of robust web application frameworks, which can enforce safer defaults and reduce the likelihood of insecure coding patterns (for example, built-in CSRF protections). ISM-1239 focuses on tooling/frameworks, while Annex A 8.28 is about the secure coding principles developers must follow.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.