CISSP - Software Development Security - Section 8.3

Assess the effectiveness of software security through auditing and logging of changes and risk analysis and mitigation.

Assess software security effectiveness by auditing change logs, reviewing access to source code repositories, and conducting risk analysis of identified weaknesses. Use audit evidence to demonstrate whether security controls in the development environment are operating as intended or require remediation.

software auditingchange loggingrisk analysissecurity effectiveness

Practice question for this objective

Free sampleSoftware Development Securitymedium

An internal auditor reviewing a SaaS provider's secure development lifecycle finds that the team runs static analysis on every pull request but the security manager cannot say whether the programme is actually reducing risk year on year. Which approach would BEST demonstrate the effectiveness of the secure development controls to the audit committee?

  • APublish the count of static analysis findings raised each month against each repository.
  • BTrack trends in the density of exploitable defects reaching production and the mean time to remediate them. Correct
  • CReport the percentage of developers who have completed the annual secure coding training module.
  • DProvide screenshots of dashboards showing that every pull request passes the security gate before merging.
Use outcome-based metrics such as exploitable defect density and mean time to remediate to evidence software security effectiveness. Effectiveness is measured by outcomes, not activity. Defect density in production and remediation latency are leading indicators of residual risk to the business and can be trended over time, compared to thresholds, and tied back to risk appetite. Activity metrics such as tool runs, finding counts, and training completion are useful operationally but do not, on their own, prove that risk is being reduced.

Why A is wrong: A raw finding count tells the committee how noisy the tool is, not whether security has improved; rising or falling counts can be driven by tool tuning, code volume, or false positives, so the number alone is not a measure of effectiveness.

Why B is correct: Defect density in production combined with remediation time directly reflects whether the controls are catching real issues earlier and shrinking exposure, which is what an audit committee needs to judge effectiveness over time against an explicit risk appetite.

Why C is wrong: Training completion is an input metric and indicates capability rather than outcome; high completion does not prove that the resulting code is more secure, so it cannot answer the committee's question.

Why D is wrong: Showing that gates run is process evidence and confirms compliance with the workflow, but it does not demonstrate that the controls actually reduce residual risk in production.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Software Development Security objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.