If you run a small business, the words “Project Management” probably don’t conjure up images of certified professionals carrying clipboards and Gantt charts. More likely, it looks like a frantic Tuesday where you decide to migrate to a new CRM, or a quick huddle to launch a new website feature.
So, when you see ISO 27001 Annex A 5.8: Information Security in Project Management, it is easy to panic. You might think, “We don’t have a Project Management Office. Do we need one?”
The answer is no. You don’t need more bureaucracy; you just need to stop stepping on landmines. This control is simply ensuring that security is part of the conversation before you start building, buying, or changing things. Here is how to implement it in a small business without slowing down your growth.
Table of contents
What is Annex A 5.8 Actually Asking For?
The standard requires that “Information security shall be integrated into project management.”
In a small business context, a “project” is anything that introduces change. It could be:
- Switching from Dropbox to Google Drive.
- Hiring a contractor to build a mobile app.
- Moving to a new physical office.
- Launching a new marketing campaign that collects customer emails.
The goal of Annex A 5.8 is to prevent the “Oh no” moment—that moment three days after launch when you realize your new app exposes all your customer data to the public internet.
Why This Saves You Money (Not Just Compliance)
For a small business, resources are tight. You cannot afford to build something twice. If you build a new feature and then find out it’s insecure, you have to tear it down and start again. That is expensive.
Implementing this control is essentially Security by Design. It forces you to check the brakes before you drive the car, saving you from a costly crash (and a PR nightmare) down the road.
How to Implement This Without Hiring a PM
You can satisfy this requirement using a simple 3-step checklist for every new initiative. You don’t need expensive software; a simple document or a section in your project management tool (like Trello, Asana, or Jira) is enough.
Step 1: The “Kick-Off” Risk Check
Before you spend a dollar or write a line of code, ask three questions:
- What data will this project touch? (Is it sensitive? PII? Financial?)
- Where will the data go? (Cloud? A laptop? A third-party vendor?)
- Who needs access? (Just us? Contractors? The whole world?)
Record the answers. If the answers make you nervous, you have identified a security risk. Congratulations, you just did “Information Security in Project Management.”
Step 2: Define Simple Requirements
Don’t be vague. Telling a developer or a vendor to “make it secure” is useless. Based on your risk check, set clear rules:
- “All passwords must be encrypted.”
- “The new HR platform must support Two-Factor Authentication (2FA).”
- “The marketing list must be stored in the EU (for GDPR).”
Step 3: The “Go/No-Go” Gate
This is the most critical step. Before you flip the switch to go live, someone must verify that the requirements from Step 2 were actually met.
In a small business, this might just be the CEO or the IT Lead testing the system. If it doesn’t pass, you don’t launch. Document this decision. An email saying “Security checks passed, approved for launch” is valid audit evidence.
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Handling “Agile” Projects
If you are a tech startup or run on Agile sprints, you don’t have distinct “phases.” That’s fine. You integrate Annex A 5.8 by:
- Tagging Tickets: Add a “Security Review” tag to any ticket that involves data or access changes.
- Definition of Done: Add a checklist item to your completion criteria: “Security implications reviewed.”
Evidence for the Auditor
When the auditor comes knocking, they want to see that you didn’t just get lucky—they want to see a process. You should be prepared to show:
- A Project Management Policy: A short document stating that all projects must consider security risks.
- Project Risk Assessments: The notes from your “Kick-Off” checks.
- Testing Records: Proof that you tested the security before going live.
If you are staring at a blank page and don’t know how to write a Project Management Policy that fits a small business, Hightable.io is a lifesaver. Their ISO 27001 toolkits contain ready-made Project Initiation and Security Risk templates that are perfectly sized for smaller organizations, helping you look professional without the administrative bloat.
Common Pitfalls to Avoid
Ignoring Non-IT Projects:
Don’t forget that moving offices or changing your shredding provider is also a project. Security isn’t just code; it’s physical access too.
Over-Complicating It:
Do not try to implement a PRINCE2 methodology for a 5-person company. Keep the process proportional to your size. A checklist is fine; a 50-page manual is not.
Conclusion
ISO 27001 Annex A 5.8 is about building a habit of “measuring twice, cutting once.” By taking five minutes at the start of a project to ask about security risks, you protect your small business from the kind of mistakes that could put you out of business. Keep it simple, document your decisions, and use the templates at Hightable.io to get it right the first time.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
