Why it matters
Code you didn't write yourself still needs to meet your security bar before it ships.
How a self-led small team implements it
If you use contractors, hold them to the same secure coding/review standard as internal engineers — document that expectation.
What auditors expect to see
Contractor agreements referencing security standards.
Track A.8.30 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS