CVE-2023-32642

Requires developer testing and evaluation that can identify deviations from required coding, design, or documentation conventions.

Mandates use of an SDLC that incorporates security and privacy conventions into system acquisition, development, and management.

A.5.1 only requires the existence of an overarching policy and topic-specific policies (including one on secure development); it does not itself enforce conventions in architecture, code, design or artifacts, so the weakness can still arise and be exploited.

Defined roles can assign responsibility for convention compliance but do not ensure it occurs.

Directly requires compliance with rules and standards, which include coding and documentation conventions.

Documented procedures can specify conventions but do not guarantee they are followed.

A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing and developer training that reach a minority slice of convention-adherence failures (those caught by design reviews, code scans or secure-coding rules), but most convention violations arise from inconsistent application, undocumented expectations or non-security conventions outside its scope.

A.8.27 mandates establishing and applying security engineering principles (security by design, least privilege, default deny, fail securely, distrust external input, hardening, design review against attack patterns) that directly address and stop insufficient adherence to conventions from producing exploitable defects; the bounded remainder is non-technical conventions (e.g. purely stylistic documentation or naming) outside the clause's security-engineering focus.