Ensure Code Reviews for Secure Software Design
Code reviews are used to verify software security and adherence to secure design principles.
Plain language
A code review is like having a second pair of eyes to check software for any security issues. If we skip this step, there's a risk hackers could exploit hidden weaknesses in the software, leading to data breaches or other cyber threats.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
Code reviews are utilised to ensure software components meets Secure by Design principles and practices as well as secure programming practices.
Why it matters
Without code reviews, software may contain vulnerabilities that hackers can exploit, leading to serious security breaches.
Operational notes
Ensure that code reviews remain a consistent part of your development process by addressing any bottlenecks promptly and maintaining comprehensive checklists.
Implementation tips
- The IT team should set up a code review process. This involves scheduling regular sessions where another developer checks the work for security flaws before it's finalised.
- Managers need to ensure that their teams are aware of secure coding practices. This can be done by organising training sessions to keep everyone's skills up to date.
- Developers should document code changes clearly. This helps reviewers understand what was changed and ensures no security gaps are introduced accidentally.
- The project manager should monitor code review schedules. Ensuring these reviews happen regularly and are not skipped when deadlines loom ensures consistent security checks.
- IT leads should set up checklists of common security pitfalls. Reviewers can then use these checklists as guides when evaluating code to ensure all bases are covered.
Audit / evidence tips
- Askthe code review records: Request documentation showing the reviews were completed for specific software releasesLook atdates, reviewer names, and notes on identified and fixed issuesGoodis a clear record showing regular reviews with detailed feedback
- Askif training records are available: Request evidence of secure coding training sessions for developersLook atattendance lists and course contentGoodincludes dates, content specifics, and proof that all team members attended
- Askthe workflow documentation: Request a description of how code reviews are integrated into the development processLook atdocumented steps and how feedback is tracked. A well-documented workflow shows a strong emphasis on incorporating security into everyday practices
- Askexamples of feedback given in recent code reviewsLook atwhether the suggestions led to improvements in security. Good documentation shows specific issues identified and how they were resolved
- Askthe security checklist used in reviews: Request the actual checklists used by reviewersLook atcomprehensive lists that cover common security vulnerabilities. A thorough and specific checklist demonstrates a proactive approach to secure coding
Cross-framework mappings
How ISM-2060 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.25 | ISM-2060 requires code reviews to be utilised to confirm Secure by Design and secure programming practices are being followed | |
sync_altPartially overlaps(1)expand_less | ||
| Annex A 8.29 | ISM-2060 requires code reviews to validate Secure by Design and secure programming practices in software | |
handshakeSupports(2)expand_less | ||
| Annex A 8.27 | ISM-2060 requires code reviews to check that implementations reflect Secure by Design and secure programming practices | |
| Annex A 8.28 | Annex A 8.28 requires secure coding principles to be applied throughout software development to prevent vulnerabilities | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.