What is the UK’s Software Security Code of Practice?
The Software Security Code of Practice is a UK Government initiative designed to strengthen the security of software across the digital economy.
Developed by the UK Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC), the Code sets out voluntary principles to help organisations design, develop and maintain secure software throughout its lifecycle.
The Code was developed in collaboration with industry stakeholders, including ISACA, bringing together expertise from government, industry and the professional cybersecurity community.
ISACA also supports the initiative through the Software Security Code of Practice Ambassador Scheme, helping promote secure-by-design practices and strengthen resilience across software supply chains.
How the Software Security Code of Practice works
The Software Security Code of Practice sets out 14 voluntary principles designed to improve the security of software development and software supply chains.
The guidance applies to organisations involved in building, procuring and deploying software and focuses on strengthening security across the software lifecycle, including:
- secure design and development
- protection of build environments
- secure deployment and maintenance
- communication with customers about vulnerabilities and updates
By establishing a shared baseline for secure software development, the Code helps organisations improve resilience across digital ecosystems and supply chains.
Read the full Software Security Code of PracticeISACA’s role as an Ambassador
ISACA participates in the Software Security Code of Practice Ambassador Scheme, which brings together organisations committed to supporting awareness and adoption of the Code.
Through its global community of digital trust professionals, ISACA helps organisations understand how secure-by-design principles can be applied in governance, risk management and operational practices.
ISACA also contributed industry expertise during the development of the Code and continues to engage with policymakers and industry stakeholders to support its implementation.
Related Resources
