ISO 27001:2022 Application Security Controls: What Enterprise IT Actually Owes the Auditor

“Can you walk me through how your ISO 27001:2022 secure development controls apply to each internally developed application in your environment?”

AI Platform

Enterprise AI

Build AI-powered apps without exposing your data to anyone.

See How

That question arrived during a surveillance audit. The company had its certificate. The Statement of Applicability was signed. What was not ready was the answer, because the application estate, the ERP extensions, the departmental workflow tools, the AI-assisted module finance built last spring, had never been mapped to Annex A.

That gap is the operational challenge ISO 27001:2022 created for enterprise IT.

What the 2022 Revision Actually Changed

ISO 27001:2013 allowed organizations to acknowledge application security controls without specifying how they applied to internal builds. The 2022 revision removed that space. Controls A.8.25 through A.8.29 make application security an explicit lifecycle obligation: a documented secure development lifecycle, security requirements captured before implementation, secure architecture principles, secure coding practices with evidence, and security testing before acceptance into production.

AI Platform

Enterprise AI

AI for the enterprise — built on security, not around it.

Get Started

The transition deadline was October 2025. These are now active certification obligations, not aspirational references. Unlike sector-specific frameworks such as HITRUST certification for healthcare applications, ISO 27001:2022 applies across every industry, which means every internally built enterprise application is in scope regardless of sector. For enterprise IT teams already using CloudApper AI to build governed internal applications, the controls that A.8.25 through A.8.29 require are embedded in how the platform builds every application. For teams relying on unmanaged low-code tools or AI coding assistants, those controls represent an obligation without a systematic answer.

The Scope Gap Auditors Are Finding

Most enterprise SDLC policies cover applications built by a central development team through a formal release process. That coverage stops at the boundary of the team that follows it. Business units commission departmental tools. IT teams extend ERP and HCM platforms with custom modules. AI coding assistants generate application code that enters production without passing through the security review stages the policy describes.

AI Platform

Enterprise AI

Modernize legacy systems with enterprise-grade AI.

Learn More

The result is a gap between the ISMS scope document and the actual application estate. When an auditor asks which applications are governed by A.8.25 through A.8.29, the honest answer frequently includes applications nobody documented. An enterprise application security review process designed for a central team does not extend automatically to applications built outside it. That is a scope failure, and it is what ISO 27001:2022 surveillance audits are finding.

What the Evidence Trail Demands

The ISMS is not looking for perfect applications. It is looking for documented security activity at each stage of development. For A.8.26, that means security requirements were identified before any build began. For A.8.28, it means coding standards were applied and reviewed. For A.8.29, it means security testing results exist and were assessed before acceptance.

AI Platform

Enterprise AI

Enterprise AI that fits your compliance, not the other way around.

Explore CloudApper

When those activities happen inside a governed platform, the evidence trail is part of the platform’s process. When they happen outside one, inside a low-code tool with no governance layer or an AI-generated codebase carrying a 40 to 45 percent vulnerability rate, the evidence does not exist because nobody created it.

AI Platform

Enterprise AI

Enterprise AI that's secure enough for the systems you can't risk.

Explore Now

The missing actor is often the business-side application owner, the operations director or logistics manager who commissioned the application without engaging the ISMS team. A.8.26 requires security requirements to be identified. If that conversation never happened, the requirement was never met. An enterprise AI coding governance framework that covers business-commissioned applications closes this gap in a way a policy update alone cannot.

That is the problem CloudApper AI was built to address. When a Head of Applications or Director of IT describes what they need, the platform builds the application within a governed environment where security requirements, architecture controls, and deployment approvals are embedded in how every build is produced. The audit evidence is inherent to the platform. For organizations managing their internal application inventory alongside AI readiness and governance obligations, every application built through CloudApper AI enters the audit record ready, not after remediation.

Enterprise IT teams managing ISO 27001:2022 certification requirements across a growing internal application estate can learn how CloudApper AI embeds application security controls into every governed build, from the first description of a need to final acceptance. Contact the CloudApper team to walk through how the platform keeps internally built applications within ISMS scope.