Control A.8.27Secure system architecture and engineering principles
Principles for engineering secure systems must be established, documented, maintained and applied to any information system development activities.
Principles rather than rules, and the distinction is the point: a principle guides a decision nobody anticipated, and a rule covers the cases somebody thought of.
The familiar set — least privilege, defence in depth, fail securely, minimise attack surface, secure defaults, separation of concerns, don’t trust input from anywhere — and whatever else the organisation’s own experience has taught it.
Maintained matters because architecture changes. Principles written for systems inside a perimeter need revisiting for systems assembled from managed services, where the trust boundaries sit in different places and the provider owns some of them.
The value of documenting principles is in review: they give a designer something to design against and a reviewer something to assess against, other than personal preference. Where they do not exist, security review becomes an argument between individuals and its outcome depends on who is in the room.
How to put this in place
Design choices shape security for the life of a system. Your ISMS needs a small set of design principles, applied when systems are planned, so weaknesses are avoided rather than patched.
- Write a short set of security design principles, such as least privilege and defence in depth.
- Decide which projects and changes need a design review.
- Review designs against the principles before building.
- Record decisions and agreed exceptions.
- Update the principles from review findings and incidents.
Evidence an auditor usually looks for: the design principles, and design review records for recent significant changes.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.