Control A.8.26Application security requirements
What it means in practice
Information security requirements must be identified, specified and approved when developing or acquiring applications.
This applies to what is bought as well as what is built, and the acquisition half is the one more often neglected: requirements specified for a development project and absent from a procurement leave the security properties of a purchased application to whatever the vendor chose.
Requirements come from the risk assessment, from the classification of the information the application will handle, from legal and regulatory obligations under A.5.31, and from the organisation’s own architecture standards.
Approved is the word that gives the control teeth. Requirements identified and not approved are suggestions, and they lose to schedule.
The requirements most often missing are the operational ones — logging sufficient for A.8.15, the ability to enforce the access model in A.8.3, support for the organisation’s authentication, and the ability to export and delete data for A.8.10. Each is cheap to specify beforehand and expensive or impossible to add later.
How to put this in place
Security added after the contract or design is settled is expensive and often incomplete. Your ISMS needs security requirements set early for each application, based on its data and risks.
- Classify the data and the risks of each new application or major change.
- Derive requirements such as authentication, access control, logging and data protection.
- Put them into specifications, tenders and acceptance criteria.
- Check them at acceptance and record the outcome.
- Reuse and improve a requirements template, adjusted to each system.
Evidence an auditor usually looks for: requirements documents or tender criteria showing security requirements, and acceptance records checking them.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Generative AI Security Standard
in Generative AI SecurityIts Framework References list this control. Supported by: Requirements and Data exposure: application security requirements for an LLM feature. - Excel
LLM Application Threat Catalogue
in Generative AI SecurityIts Framework References list this control. Supported by: The whole catalogue: the application security threats a feature is designed and tested against. - Excel
AI Security Findings & Exceptions Register
in Generative AI SecurityIts Framework References list this control. Supported by: Findings sheet: a gap in an application's security requirements is recorded, rated and tracked.