ASD ISM 2062 Unit and integration testing for code quality
What it says
Unit testing and integration testing, covering both positive and negative use cases, are used for software components to ensure code quality and correctness.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTesting software parts with various cases ensures they work correctly and are built well.
When software is built, each part needs to be tested separately and together to make sure everything works properly. If this isn't done, you might end up with software that has hidden errors, which could cause it to fail or work incorrectly, leading to frustration and potential security risks.
Free. Save your status, tasks and notes.
Why it matters
If unit and integration testing are not done, the software might have unexpected errors, leading to operational failures or security vulnerabilities.
How to implement
The IT team should conduct unit tests for each software component.
Break down the software into individual parts and run tests on each to check they do their job properly.
The software development manager should ensure integration tests are performed.
After individual testing, the team should run the parts together to ensure they interact as expected.
Developers should include both positive and negative test scenarios.
They should simulate both when software works correctly and when it fails, ensuring all possible outcomes are covered.
Project managers should create a testing schedule.
Set clear milestones for when unit and integration testing should take place, adjusting timelines if necessary.
QA (Quality Assurance) teams should be involved early.
They should review testing processes to make sure tests are thorough and catch issues before the software is deployed.
Keep it running
Regular reviews of the testing process help ensure all software changes are tested thoroughly. Keep communication open between developers and QA for robust testing outcomes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the testing documentation: Request records of unit and integration testing results.
Look at
the variety and completeness of scenarios covered in these tests.
Good evidence
includes a checklist of tests conducted, including expected outcomes and discrepancies noted.
- Check 2 of 5What an auditor asks for
Ask for
the testing schedule: Request a timeline that includes planned and completed testing phases.
Look at
whether tests were performed as scheduled.
Good evidence
shows clear adherence to the testing plan.
- Check 3 of 5What an auditor asks for
Ask for
defect reports: Request documentation showing any issues found during testing.
Look at
how these issues were addressed and resolved.
Good evidence
provides evidence of corrective actions taken promptly.
- Check 4 of 5What an auditor asks for
Ask for
meeting records: Request minutes or notes from team meetings discussing testing outcomes.
Look at
decisions made and actions planned based on these discussions.
Good evidence
includes detailed notes on problem-solving strategies.
- Check 5 of 5What an auditor asks for
Ask for
QA reviews: Request proof of quality assurance reviews.
Look at
how QA findings were actioned.
Good evidence
includes records of QA input and how it improved test procedures.
Mappings
Closest match in ISO/IEC 27001: A.8.29, Security testing in development and acceptance, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.29.
ISM-2062 requires unit and integration testing (including positive and negative use cases) to assure code quality and security. This directly fits within ISO/IEC 27001:2022 Annex A 8.29, which requires defined and implemented security testing processes across the development life cycle and acceptance activities. Annex A 8.29 is broader in that it can include additional security testing types (e.g. dynamic testing, penetration testing, acceptance criteria) beyond unit and integration testing that ISM-2062 explicitly calls out.
This control depends on A.8.28.
ISM-2062 requires unit and integration testing (positive and negative cases) to validate code quality and security. This supports ISO/IEC 27001:2022 Annex A 8.28 by providing a verification mechanism to demonstrate that secure coding principles are correctly implemented and that security-relevant behaviour holds under expected and misuse conditions. Annex A 8.28 focuses on the coding practices themselves, while ISM-2062 focuses on the testing evidence that those practices are effective.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.