Under ISO 27001 control 8.30, you manage outsourced developers by setting minimum security requirements in the agreement, monitoring progress, and reviewing what they deliver. Keep the contract terms, review records and test results for outsourced code, and apply the same acceptance rules you use in house.
Why the control exists
Software written by an outside party can carry vulnerabilities you did not choose and cannot see. The control asks you to keep security oversight even when someone else holds the keyboard. A secure development policy covers it for smaller and mid sized companies. Larger ones may write an outsourced development procedure.
What to put in the agreement
The guidance says to define minimum security requirements for service agreements. Practical items:
- Secure coding expectations and who sets them
- Access rules for repositories and environments
- Review and testing duties before delivery
- Handling of vulnerabilities found after delivery
- Rights to see progress and evidence
Monitor and review
You need a process to monitor and review development progress. The guidance mentions using the provider's own tools, such as monitoring reports and dashboards.
| Oversight step | Evidence |
|---|---|
| Agree requirements | Signed agreement with security terms |
| Control access | Access list for the contractor accounts |
| Watch progress | Reports or dashboard exports |
| Check deliveries | Pull request reviews and scan results |
| Accept work | A dated acceptance record |
The key point: outsourced code goes through the same gate as your own. If it fails your checks, it does not merge.
What auditors check
Auditors may check whether software built by external parties follows proper practice and your security rules. The source does not list fixed artifacts, so lead with the policy, one sample agreement and one delivery with review and test records.
People
Staff who direct outsourced work should know why it must be managed and how to monitor and review it. Keep training notes for them.
Try it yourself
Open the demo and look at how a pull request is held until checks pass. That same gate is what protects you from unreviewed contractor code.
Click through it at your own pace, or open it full screen.
Where tooling helps
Safeguard offers policies and gates on pull requests and dependency scanning, which apply to contractor code like any other. Contracts remain a legal task for your team. Try the free scan at gold.safeguard.sh/scan.
Quick check
Does 8.30 apply to a single freelancer?
Yes. Any external party doing development work falls under the control, whatever its size.
Should contractors get production access?
Only if the work needs it. Set access in the agreement, keep an access list, and review it.
Sources
Last reviewed: 19 October 2026.
