ASD ISM 2025 Using issue tracking for software development tasks
What it says
An issue tracking solution is used to link software development tasks to security issues and decisions, change or feature requests, programming issues, or bug fixes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConnect software tasks with security and change issues using an issue tracking tool.
Using an issue tracking system in software development is crucial because it helps keep a clear record of all the changes, problems, and security concerns tied to your software. Without this, tasks can fall through the cracks, leading to unresolved security holes or changes not being properly managed, which could result in unexpected expenses or even a data breach.
Free. Save your status, tasks and notes.
Why it matters
Without an issue tracking system, critical security flaws or required changes may be overlooked, increasing the risk of breaches and operational instability.
How to implement
The project manager should ensure that an issue tracking system, like Jira or Trello, is in place and set up.
This involves listing all current development tasks, security issues, and change requests in the system, making sure they are visible and accessible to the whole team.
Software developers should link each of their tasks to specific entries in the issue tracking system for any security or bug-related issue they are addressing.
They can do this by referencing the issue number when logging their work on a development task.
IT support staff should regularly review and update the status of reported issues in the tracking system.
They should mark issues as resolved only after proper testing and confirmation from the team that the issue is indeed fixed.
System owners must schedule regular meetings with the development and security teams to review the entries in the issue tracking system.
They should focus on prioritising issues that could impact security or critical functionalities.
The IT team should provide training for all staff involved in software development on how to effectively use the issue tracking system.
This includes how to add new issues, update existing entries, and link relevant documents or discussions.
Keep it running
Regularly update the issue tracker to reflect task status changes and ensure all security and change issues are documented and addressed promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access to the issue tracking system: Request a demonstration of how tasks related to security and changes are logged.
Look at
The detailed records of entries for completeness.
Good evidence
A well-documented and updated log of issues and corresponding tasks.
- Check 2 of 5What an auditor asks for
Ask for
Regular meeting documentation where issue tracking updates are discussed.
Look at
Consistent records where issues are analysed and prioritised.
Good evidence
Clear documentation outlining issue discussions and decisions made.
- Check 3 of 5What an auditor asks for
Look at
Entries to confirm they reference such documents.
Good evidence
Entries being seamlessly linked to supporting documentation.
- Check 4 of 5What an auditor asks for
Ask for
Reports on issue status changes over the last few months.
Look at
The time taken for changes from opened to resolved statuses.
Good evidence
Timely updates with logical progressions and resolutions.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request documents showing staff training sessions related to using the issue tracking system.
Look at
Attendance lists and session content.
Good evidence
Comprehensive training records indicating active participation and understanding.
Mappings
Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.25.
ISM-2025 requires an issue tracking solution to link software development tasks to security issues/decisions and to change, feature and defect work. This supports ISO/IEC 27001:2022 Annex A 8.25 by providing a practical mechanism to evidence and enforce secure development lifecycle rules through traceable tickets, workflows and approvals. Annex A 8.25 is broader (covering the full set of SDL rules), while ISM-2025 is focused specifically on traceability via issue tracking.
This control supports A.8.32.
ISM-2025 requires using an issue tracking tool to link development tasks to security decisions and change/feature requests. This supports ISO/IEC 27001:2022 Annex A 8.32 by enabling consistent recording, review and traceability of information system changes via tickets that capture rationale, impact and approvals. Annex A 8.32 is broader because it requires formal change management procedures beyond tooling, whereas ISM-2025 is a specific tooling/traceability expectation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.