ASD ISM 2121 Prevent using developers without cyber security skills
What it says
Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks are not used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure software developers possess the cyber security knowledge and skills required for their specific projects or tasks before they are assigned to them.
Before letting a developer work on a project, the organisation confirms they actually understand the cyber security demands of that specific work, not just how to code. If a developer does not have the secure-coding skills the project needs, they are not put on it until the gap is closed. This stops under-skilled developers from quietly building insecure software that attackers can later exploit.
Free. Save your status, tasks and notes.
Why it matters
If under-skilled developers are assigned to projects, they introduce insecure coding patterns such as missing or weak input validation, broken authentication and authorisation logic, injection-prone queries, unsafe handling of secrets, and flawed cryptography. These defects are baked into the software at build time, are expensive to remediate later, and create exploitable vulnerabilities that can lead to data compromise or system takeover. Because the gap is a skills gap, the same classes of weakness tend to recur across every project the developer touches.
How to implement
Define, for each project or task type the organisation undertakes, the specific cyber security skills it demands (for example input validation, secure authentication and authorisation, cryptographic implementation, secure secret handling) so assignment decisions have a concrete benchmark.
Build and maintain a developer competency matrix that records which of those cyber security skills each developer has demonstrated, with the date and method of assessment.
Before assigning a developer to a project, compare their recorded competencies against that project's required skills and only assign them when the required skills are met.
Assess competency using objective evidence such as a secure-coding test, review of prior secure code, or recognised certification, rather than relying on years of experience alone.
Reassess a developer's cyber security competency whenever they change role or are assigned a new project type that requires skills outside their demonstrated experience.
Where a required skill is absent, withhold the assignment and close the gap first by pairing the developer with a competent peer, providing targeted upskilling, or reassigning the work to a qualified developer.
Keep it running
Map the specific cyber security skills each project or task type demands (for example web app security, API authentication, cryptographic implementation, or secure handling of personal data) and match developers against that profile before assignment, not just against general coding ability. Reassess a developer's competency whenever they change role or are assigned a new project type that requires skills outside their demonstrated experience. Where a needed skill is absent, either reassign the work, pair the developer with a competent peer, or close the gap through targeted upskilling before they touch production code. Keep the assessment current as threats and the organisation's technology stack evolve, since yesterday's competent developer may lack today's required knowledge.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request a list of current development projects and the skills assessment records for the developers assigned to a sample of them.
Look at
Check that each assigned developer has a recorded assessment matching their cyber security skills to that project's specific requirements, and note the date of the assessment against the date of assignment.
Good evidence
Every sampled developer has an assessment dated before their assignment that addresses the cyber security skills the project actually requires.
- Check 2 of 5What an auditor asks for
Ask for
Ask for an example of a developer who recently moved to a new project type or role, along with their competency records before and after the move.
Look at
Look for evidence that their competency was reassessed against the requirements of the new work rather than carried over unchanged from the previous role.
Good evidence
A fresh assessment exists for the new project type or role, and it covers the cyber security skills that work requires.
- Check 3 of 5What an auditor asks for
Ask for
Request the assessment record for a developer whose skills assessment flagged a gap, together with the project's assignment or work allocation records.
Look at
Check what happened after the gap was identified and whether the developer contributed code to the project before it was addressed.
Good evidence
The work was withheld, reassigned, or paired, or the gap was closed with training or support, before the developer contributed code.
- Check 4 of 5What an auditor asks for
Ask for
Request the skills matrix or competency register used to assess developers.
Look at
Check that it names the specific cyber security skills relevant to the organisation's project types rather than only generic coding ability, and that entries have been kept current.
Good evidence
The register lists project-relevant cyber security skills against each developer and entries are up to date.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the engagement records for a contractor or external development firm used on recent development work.
Look at
Look for evidence that the organisation verified the cyber security skills required for that specific work before the firm or contractor was used.
Good evidence
Verification of the required cyber security skills was completed and recorded before the external developers started work.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.6.3.
ISM-2121 requires organisations to avoid using developers who lack sufficient cyber security knowledge and skills for the work they are assigned. ISO/IEC 27001:2022 Annex A 6.3 overlaps by requiring appropriate information security awareness, education and training aligned to job function, which is a primary mechanism for building and maintaining developer security competence. Annex A 6.3 is broader across all personnel and emphasises ongoing training, while ISM-2121 is specifically about developer suitability/assignment decisions for projects or tasks.
This control supports A.8.25.
ISM-2121 requires that only developers with sufficient cyber security skills are used on relevant projects or tasks. ISO/IEC 27001:2022 Annex A 8.25 is a prerequisite in practice because establishing and applying secure development rules defines the security competencies developers must understand and apply to be considered 'sufficiently skilled'. Annex A 8.25 focuses on organisational SDLC rules and practices, while ISM-2121 focuses on staffing decisions based on developer capability against those rules.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.