CISSP - Software Development Security (10% of the exam) - Section 8.3

Assess the effectiveness of software security through auditing and logging of changes and risk analysis and mitigation.

Assess software security effectiveness by auditing change logs, reviewing access to source code repositories, and conducting risk analysis of identified weaknesses. Use audit evidence to demonstrate whether security controls in the development environment are operating as intended or require remediation.

software auditingchange loggingrisk analysissecurity effectiveness

Practice question for this objective

Free sampleSoftware Development Securitymedium

An internal auditor reviewing a SaaS provider's secure development lifecycle finds that the team runs static analysis on every pull request but the security manager cannot say whether the programme is actually reducing risk year on year. Which approach would BEST demonstrate the effectiveness of the secure development controls to the audit committee?

APublish the count of static analysis findings raised each month against each repository.
BTrack trends in the density of exploitable defects reaching production and the mean time to remediate them. Correct
CReport the percentage of developers who have completed the annual secure coding training module.
DProvide screenshots of dashboards showing that every pull request passes the security gate before merging.

Use outcome-based metrics such as exploitable defect density and mean time to remediate to evidence software security effectiveness. Effectiveness is measured by outcomes, not activity. Defect density in production and remediation latency are leading indicators of residual risk to the business and can be trended over time, compared to thresholds, and tied back to risk appetite. Activity metrics such as tool runs, finding counts, and training completion are useful operationally but do not, on their own, prove that risk is being reduced.

Why A is wrong: A raw finding count tells the committee how noisy the tool is, not whether security has improved; rising or falling counts can be driven by tool tuning, code volume, or false positives, so the number alone is not a measure of effectiveness.

Why B is correct: Defect density in production combined with remediation time directly reflects whether the controls are catching real issues earlier and shrinking exposure, which is what an audit committee needs to judge effectiveness over time against an explicit risk appetite.

Why C is wrong: Training completion is an input metric and indicates capability rather than outcome; high completion does not prove that the resulting code is more secure, so it cannot answer the committee's question.

Why D is wrong: Showing that gates run is process evidence and confirms compliance with the workflow, but it does not demonstrate that the controls actually reduce residual risk in production.

See more CISSP practice questions, answers explained.

Exam traps in Software Development Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Provide the regulator with the raw scan results and penetration test reports so they can draw their own conclusions.
Why it is wrong: Handing over raw artefacts shifts the assessment burden to the regulator and does not demonstrate that the insurer has measured its own security effectiveness, which is itself a deficiency worth a finding.
Require each service team to retain its own logs locally for at least one year before deletion.
Why it is wrong: Local retention preserves volume but not coherence; without a common schema or correlation, investigators still cannot follow a request across services, and locally held logs are easier to tamper with than centrally aggregated copies.
Emergency changes skip risk assessment because the urgency of the incident overrides normal governance until service is restored.
Why it is wrong: Mature change management never skips risk assessment; it compresses the timeline and may use a smaller emergency review board, but the assessment itself remains. A candidate equating urgency with absence of governance picks this.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.