Control A.8.26Application security requirements
Information security requirements must be identified, specified and approved when developing or acquiring applications.
This applies to what is bought as well as what is built, and the acquisition half is the one more often neglected: requirements specified for a development project and absent from a procurement leave the security properties of a purchased application to whatever the vendor chose.
Requirements come from the risk assessment, from the classification of the information the application will handle, from legal and regulatory obligations under A.5.31, and from the organisation’s own architecture standards.
Approved is the word that gives the control teeth. Requirements identified and not approved are suggestions, and they lose to schedule.
The requirements most often missing are the operational ones — logging sufficient for A.8.15, the ability to enforce the access model in A.8.3, support for the organisation’s authentication, and the ability to export and delete data for A.8.10. Each is cheap to specify beforehand and expensive or impossible to add later.
How to put this in place
Security added after the contract or design is settled is expensive and often incomplete. Your ISMS needs security requirements set early for each application, based on its data and risks.
- Classify the data and the risks of each new application or major change.
- Derive requirements such as authentication, access control, logging and data protection.
- Put them into specifications, tenders and acceptance criteria.
- Check them at acceptance and record the outcome.
- Reuse and improve a requirements template, adjusted to each system.
Evidence an auditor usually looks for: requirements documents or tender criteria showing security requirements, and acceptance records checking them.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.