Control A.5.8Information security in project management
Information security must be integrated into project management.
The purpose is that security requirements are identified and addressed while a project can still accommodate them cheaply, rather than assessed at the end when the only options are delay or acceptance. It applies to projects of any kind, not only technology projects — a new office, a new market, an outsourcing programme and a new product each change the risk picture.
In practice this means security requirements in the project’s own requirements, risks in the project’s own risk register, and a security judgement at the gates the project already has.
The failure mode is universal and recognisable: security engaged at the point of go-live, presenting findings that are all expensive to act on. The control exists to move that conversation earlier, and its effectiveness is visible in whether security findings arrive as design input or as late objections.
How to put this in place
Security is cheapest to build in at the start of a project and costly to bolt on after go-live. Without a checkpoint, new systems, data flows and suppliers arrive without anyone having considered risk.
- Decide which projects need a security step, covering business projects as well as IT ones.
- Add a short risk question set at project start, one page for small projects.
- Add a security sign-off before go-live.
- Involve the ISMS manager where a project changes systems, data or suppliers.
- Keep the completed checklists with the project records.
Evidence an auditor usually looks for: the project method showing the security step, and completed checklists or risk notes for a sample of recent projects.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.