Quick answer
Secure software starts with access control, encryption, tested backups, prompt patching and secure development practice, aligned to the OWASP Top 10. UK businesses should also plan for UK GDPR duties and consider Cyber Essentials certification. Ask suppliers how they handle each from the start.
Security is a design decision, not an add-on
Retrofitting security is expensive and rarely complete. Good teams design for it from the first sprint: threat-thinking about who might misuse the system, limiting what each user can do, and testing as they build.
The OWASP Top 10
The OWASP Top Ten is the most widely used list of critical web application risks, including broken access control, injection and security misconfiguration. A competent supplier knows it well and should be able to explain how each risk is addressed in your project.
The basics every system needs
- Role-based access control and least privilege
- Strong authentication, with multi-factor authentication where possible
- Encryption of data in transit and at rest
- Audit logs that record who did what and when
- Backups that are tested by restoring them
- Regular dependency updates and patching
- Secure configuration and secrets management
- Monitoring and an incident response plan
UK GDPR and data protection
If your software handles personal data, UK GDPR applies. That means a lawful basis for processing, data minimisation, security appropriate to the risk, and the ability to respond to people’s rights requests. The Information Commissioner’s Office provides UK GDPR guidance for organisations. Serious infringements can attract fines of up to £17.5 million or 4% of annual global turnover, whichever is higher, which is why privacy by design matters. This is general information, not legal advice.
Cyber Essentials
Cyber Essentials is a UK government-backed scheme that certifies basic cyber hygiene, and some customers and public-sector contracts require it. The NCSC Cyber Essentials overview explains the requirements. Ask whether your supplier’s practices support your certification.
A pre-launch security checklist
- Authentication and password reset flows tested
- Access roles reviewed against least privilege
- Dependencies updated and known vulnerabilities fixed
- Secrets and keys stored outside the code
- Backups configured and restore tested
- Logging and alerting in place
- Data protection notices and processes ready
Questions to ask your supplier
- How do you protect against the OWASP Top 10?
- How are secrets and credentials managed?
- What testing happens before every release?
- How quickly are vulnerabilities patched after launch?
- Who is responsible for incident response?
Testing and ongoing care
Automated tests, code review and periodic penetration testing catch problems before attackers do. After launch, patching and monitoring are continuous work; see what maintenance includes and our plans with tiers that add penetration testing and compliance reviews. Our custom software development projects follow these practices by default, and the complete guide shows where security fits in the process.
Make sure ownership and handover are covered (who owns the code) and keep infrastructure efficient with cloud cost optimisation.
Frequently asked questions
Do I need Cyber Essentials?
Not legally in most cases, but it is a recognised baseline and is often required for certain contracts. Check your customers’ requirements.
Who is responsible for security: me or the developer?
Both. The developer builds securely; you control access, staff practices and decisions about data. Agree responsibilities in the contract.
How often should software be security tested?
Test continuously during development and consider independent penetration testing at least annually or after major changes.
Sources and further reading
Ready for a realistic number? Get an indicative price in about a minute, with no sales call.
Get an instant quoteWritten by the LOLCorp engineering team from our experience delivering custom software for UK businesses. This is general guidance, not legal or financial advice.