How to Audit ISO 27001 Annex A 5.8 Information Security in Project Management

The ultimate audit guide to ISO 27001 Annex A 5.8 Information security in project management

1. Inspect Project Initiation Documentation (PID)

Review the project initiation records for a sample of recent projects to ensure that information security objectives were defined at the outset.

• Verify that security requirements are listed alongside functional requirements in the project mandate.
• Check for the appointment of a designated Security Lead or Architect within the project team structure.
• Ensure that the project scope explicitly includes compliance with the Information Security Policy.

2. Audit Project Risk Assessments

Formalise the review of project-specific risk registers to confirm that security risks are identified, assessed, and treated throughout the project lifecycle.

• Trace identified risks to the main ISMS Risk Register where significant impact is noted.
• Verify that technical risks, such as those involving MFA bypass or data leakage, are addressed.
• Confirm that risk treatment plans have been signed off by the appropriate Asset Owner.

3. Verify Security Requirement Specifications

Examine the technical specifications for project deliverables to ensure that specific security controls are documented and measurable.

• Check for requirements related to data encryption (at rest and in transit) and IAM role definitions.
• Ensure that “Privacy by Design” principles are incorporated for projects involving personally identifiable information (PII).
• Validate that security performance metrics are included in the acceptance criteria.

4. Audit the Secure Development Lifecycle (SDLC) Integration

Audit projects involving software development to ensure that security checkpoints are integrated into every phase of the development cycle.

• Inspect evidence of automated static and dynamic application security testing (SAST/DAST).
• Verify that code reviews include a specific focus on security vulnerabilities and logic flaws.
• Confirm that developers have received training on secure coding standards relevant to the project technology.

5. Examine Third-Party Risk Assessments

Review the security due diligence performed on vendors or contractors integrated into the project delivery team.

• Inspect signed Non-Disclosure Agreements (NDAs) and “Rules of Engagement” (ROE) documents for external consultants.
• Verify that third-party access is provisioned using the principle of least privilege.
• Check for evidence that the organisation’s security requirements are reflected in the third-party contracts.

6. Validate User Acceptance Testing (UAT) for Security

Inspect the results of testing phases to confirm that security controls were validated before the project was moved into production.

• Verify that security test cases were executed and that any failures were formally remediated.
• Check for penetration test reports or vulnerability scans conducted as part of the project closure.
• Ensure that the final sign-off includes a declaration that all security requirements have been met.

7. Audit IAM Provisioning within Projects

Provision a review of how identities and access are managed within the project environment to prevent unauthorised data exposure.

• Review the IAM role matrix for the project to ensure appropriate segregation of duties.
• Verify that administrative access to project repositories and environments is protected by MFA.
• Confirm that access is revoked immediately upon a project member’s departure or project closure.

8. Inspect Project Change Management Records

Audit the change logs for projects to ensure that security impacts are evaluated whenever project scope or technical requirements change.

• Check that the Security Lead is included in the Change Advisory Board (CAB) for project-related changes.
• Verify that impact assessments include a review of the potential effect on the ISMS.
• Ensure that documentation is updated to reflect technical changes in the Asset Register.

9. Review Data Migration and Disposal Records

Examine the protocols for handling data during migrations or at the conclusion of a project to prevent data leakage.

• Verify that data migration plans include technical controls to maintain data integrity and confidentiality.
• Check for certificates of destruction or secure erasure for temporary project data or hardware.
• Ensure that data retention schedules are followed in accordance with the organisation’s policy.

10. Evaluate Project Post-Implementation Reviews (PIR)

Analyse the outcomes of project closure meetings to identify security lessons learned and opportunities for ISMS improvement.

• Review PIR reports for mentions of security incidents or “near-misses” during the project.
• Verify that any security improvements identified are fed back into the project management methodology.
• Check that senior management has reviewed the security performance of the project.

ISO 27001 Annex A.5.8 Audit Reference Matrix

Audit Step	Audit Methodology	Evidence Example
1. Project Initiation	Sample PIDs for security objective definitions.	Signed Project Mandate with Security Section.
2. Risk Management	Examine project risk logs for security entries.	Risk Register with technical mitigation plans.
3. Requirements Traceability	Review specs against final project deliverables.	Security Requirements Traceability Matrix (RTM).
4. SDLC Oversight	Inspect build pipelines for security scan triggers.	SAST/DAST scan logs and remediation tickets.
5. External Liaison	Check contractor onboarding for security briefings.	Signed ROE and NDA for external consultants.
6. Testing Validation	Review UAT scripts for security control checks.	Signed Security Test Results and UAT sign-off.
7. Access Governance	Audit project environment IAM logs.	MFA logs for project admin accounts.
8. Change Impact	Review CAB minutes for project change requests.	Change Request Form with Security Impact Assessment.
9. Data Handling	Inspect migration plans and disposal logs.	Data Migration Strategy and Disposal Certificates.
10. Lesson Learning	Review PIR reports for security feedback loops.	Post-Implementation Review minutes and ISMS updates.

About the author