Unit and Integration Testing for Code Quality
Testing software parts with various cases ensures they work correctly and are built well.
Plain language
When software is built, each part needs to be tested separately and together to make sure everything works properly. If this isn't done, you might end up with software that has hidden errors, which could cause it to fail or work incorrectly, leading to frustration and potential security risks.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
Unit testing and integration testing, covering both positive and negative use cases, are used for software components to ensure code quality and correctness.
Why it matters
If unit and integration testing are not done, the software might have unexpected errors, leading to operational failures or security vulnerabilities.
Operational notes
Regular reviews of the testing process help ensure all software changes are tested thoroughly. Keep communication open between developers and QA for robust testing outcomes.
Implementation tips
- The IT team should conduct unit tests for each software component. Break down the software into individual parts and run tests on each to check they do their job properly.
- The software development manager should ensure integration tests are performed. After individual testing, the team should run the parts together to ensure they interact as expected.
- Developers should include both positive and negative test scenarios. They should simulate both when software works correctly and when it fails, ensuring all possible outcomes are covered.
- Project managers should create a testing schedule. Set clear milestones for when unit and integration testing should take place, adjusting timelines if necessary.
- QA (Quality Assurance) teams should be involved early. They should review testing processes to make sure tests are thorough and catch issues before the software is deployed.
Audit / evidence tips
- Askthe testing documentation: Request records of unit and integration testing resultsLook atthe variety and completeness of scenarios covered in these testsGoodincludes a checklist of tests conducted, including expected outcomes and discrepancies noted
- Askthe testing schedule: Request a timeline that includes planned and completed testing phasesLook atwhether tests were performed as scheduledGoodshows clear adherence to the testing plan
- Askdefect reports: Request documentation showing any issues found during testingLook athow these issues were addressed and resolvedGoodprovides evidence of corrective actions taken promptly
- Askmeeting records: Request minutes or notes from team meetings discussing testing outcomesLook atdecisions made and actions planned based on these discussionsGoodincludes detailed notes on problem-solving strategies
- AskQA reviews: Request proof of quality assurance reviewsLook athow QA findings were actionedGoodincludes records of QA input and how it improved test procedures
Cross-framework mappings
How ISM-2062 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.29 | ISM-2062 requires unit and integration testing (including positive and negative use cases) to assure code quality and security | |
handshakeSupports(1)expand_less | ||
| Annex A 8.28 | ISM-2062 requires unit and integration testing (positive and negative cases) to validate code quality and security | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.