ISO 27001 Annex A 5.8 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 5.8 Information security in project management

1. Project Management Methodology Integration Verified

Verification Criteria: The organisation’s formal project management framework explicitly includes information security as a mandatory component for all project types.

Required Evidence: Documented Project Management Policy or Framework (e.g., PRINCE2 or Agile adaptation) showing security integration points.

Pass/Fail Test: If the project management handbook does not mention information security as a core requirement for project initiation, mark as Non-Compliant.

2. Information Security Risk Assessment Completion Validated

Verification Criteria: Every project initiated within the audit period has a recorded information security risk assessment conducted at an early stage.

Required Evidence: Project Risk Registers or Impact Assessments for at least three sampled projects, showing identified security risks and treatment plans.

Pass/Fail Test: If a major project has been initiated without a preliminary security risk assessment, mark as Non-Compliant.

3. Security Requirements Specification Records Present

Verification Criteria: Information security requirements are clearly defined within the project specification or “Definition of Done” (DoD) for technical deliverables.

Required Evidence: Project Requirement Specifications or User Stories containing specific security criteria (e.g., encryption, authentication, or logging needs).

Pass/Fail Test: If project deliverables are defined solely by functional features without explicit security constraints, mark as Non-Compliant.

4. Information Security Role Assignment Confirmed

Verification Criteria: Specific individuals or roles are assigned responsibility for information security within the project team structure.

Required Evidence: Project Org Charts or RACI matrices naming a Security Lead or appointing a security representative to the Project Board.

Pass/Fail Test: If no individual is held accountable for security deliverables within the project team, mark as Non-Compliant.

5. Secure Development and Implementation Standards Verified

Verification Criteria: For technical projects, evidence exists that secure coding or system hardening standards were applied during the implementation phase.

Required Evidence: Code review logs, automated security scanning reports (SAST/DAST), or server hardening checklists completed during the project.

Pass/Fail Test: If technical deliverables are moved to production without evidence of a security review or vulnerability scan, mark as Non-Compliant.

6. Project Milestone Approval via Security Gates Validated

Verification Criteria: The project lifecycle includes formal “Security Gates” where a security sign-off is required before progressing to the next phase.

Required Evidence: Project milestone reports or “Gate Review” minutes showing formal approval from the Information Security Manager or CISO.

Pass/Fail Test: If a project bypassed a mandatory security review to meet a deadline without a formal risk waiver, mark as Non-Compliant.

7. Data Protection Impact Assessment (DPIA) Execution Verified

Verification Criteria: Projects involving the processing of personal data have a completed DPIA or equivalent privacy assessment as required by law.

Required Evidence: Signed DPIA documents for projects involving PII (Personally Identifiable Information) or sensitive data sets.

Pass/Fail Test: If a project processing high-risk personal data lacks a formal DPIA or privacy review, mark as Non-Compliant.

8. Post-Project Security Review and Handover Confirmed

Verification Criteria: At project closure, a formal handover occurs to ensure operational teams are aware of the security controls and residual risks.

Required Evidence: Operational Handover Documents or “Service Transition” records containing security operating procedures.

Pass/Fail Test: If the operational support team has no documentation on how to maintain the security controls implemented by the project, mark as Non-Compliant.

9. Third-Party Project Security Requirements Verified

Verification Criteria: When projects involve external contractors or vendors, security requirements are included in the project-specific contracts or statements of work (SOW).

Required Evidence: Signed Statements of Work (SOW) or Vendor Contracts specifying security standards and right-to-audit clauses for the project.

Pass/Fail Test: If external parties are delivering project components without documented security obligations, mark as Non-Compliant.

10. Project Asset Integration into Asset Register Verified

Verification Criteria: New assets (hardware, software, data) created or acquired during the project are identified and added to the organisational Asset Register.

Required Evidence: Updated Asset Register showing new entries corresponding to project deliverables from the current period.

Pass/Fail Test: If project deliverables have gone live but the hardware/software assets are missing from the central inventory, mark as Non-Compliant.

About the author