ISO 27001:2022 Annex A 5.8 Information security in project management for SMEs

In this guide, I will show you exactly how small businesses and SMEs can implement ISO 27001:2022 Annex A 5.8 Information security in project management without the enterprise-level complexity. You will get a complete walkthrough of the control tailored for organizations with limited resources, along with practical examples and access to ISO 27001 templates that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience auditing businesses of all sizes. I will cut through the jargon to show you exactly what changed in the 2022 update and provide the plain-English advice you need to get your small business certified.

Key Takeaways: ISO 27001 Annex A 5.8 Information Security in Project Management (SME Edition)

For Small and Medium-sized Enterprises (SMEs), ISO 27001 Annex A 5.8 is about preventing the expensive “Oh no” moment after you launch a new tool or feature. It does not require a formal Project Management Office (PMO) or complex PRINCE2 methodologies. In an SME context, a “project” is simply any initiative that introduces change – like switching from Dropbox to Google Drive, hiring a contractor to build an app, or moving offices. This control ensures you integrate security before you start, rather than trying to bolt it on afterwards.

Core requirements for compliance include:

• Define “Project” Broadly: Do not limit this to software development. A marketing campaign collecting customer emails or a physical office move are also projects that require security checks.
• The “Kick-Off” Risk Check: Before spending money or writing code, you must ask three questions: What data is involved? Where will it go? Who needs access?
• Simple Requirements: Instead of vague instructions like “make it secure”, you must set clear rules early (e.g., “All data must be stored in the EU” or “Must support 2FA”).
• The “Go/No-Go” Gate: You must have a formal stop point before going live. A designated person (like the CEO or IT Lead) must verify that the security requirements were met before the switch is flipped.
• Agile Integration: If you use Agile, integrate security by adding a “Security Review” tag to tickets or including security checks in your “Definition of Done”.

Audit Focus: Auditors will look for “The Prevention Trail”:

1. Project Policy: “Show me your policy that states security is considered in all projects.” (A simple statement is fine).
2. Risk Records: “You launched a new website last month. Show me the notes from the planning meeting where you discussed data privacy risks.”
3. The Approval Email: “Show me the email or ticket where the IT Lead gave the final ‘OK’ to launch the new CRM system.”

SME Project Security Checklist (Audit Prep):

Phase	Action Required	Practical Example
Concept	Risk Check: Identify data & access needs.	“Will this new app store PII?”
Planning	Define Rules: Set specific security goals.	“Must use existing SSO login.”
Build	Test: Verify rules are met.	check that non-admin users cannot see data.
Launch	Go/No-Go: Final sign-off.	Email: “Security passed. Approved to go live.”

What is ISO 27001 Annex A 5.8 for SMEs?

The standard requires that “Information security shall be integrated into project management.”

In a small business context, a “project” is anything that introduces change. It could be:

• Switching from Dropbox to Google Drive.
• Hiring a contractor to build a mobile app.
• Moving to a new physical office.
• Launching a new marketing campaign that collects customer emails.

The goal of Annex A 5.8 is to prevent the “Oh no” moment, that moment three days after launch when you realize your new app exposes all your customer data to the public internet.

Why This Saves You Money (Not Just Compliance)

For a small business, resources are tight. You cannot afford to build something twice. If you build a new feature and then find out it’s insecure, you have to tear it down and start again. That is expensive.

Implementing this control is essentially Security by Design. It forces you to check the brakes before you drive the car, saving you from a costly crash (and a PR nightmare) down the road.

How to Implement ISO 27001 Annex A 5.8 for SMEs

You can satisfy this requirement using a simple 3-step checklist for every new initiative. You don’t need expensive software; a simple document or a section in your project management tool (like Trello, Asana, or Jira) is enough.

Step 1: The “Kick-Off” Risk Check

Before you spend a dollar or write a line of code, ask three questions:

1. What data will this project touch? (Is it sensitive? PII? Financial?)
2. Where will the data go? (Cloud? A laptop? A third-party vendor?)
3. Who needs access? (Just us? Contractors? The whole world?)

Record the answers. If the answers make you nervous, you have identified a security risk. Congratulations, you just did “Information Security in Project Management.”

Step 2: Define Simple Requirements

Don’t be vague. Telling a developer or a vendor to “make it secure” is useless. Based on your risk check, set clear rules:

• “All passwords must be encrypted.”
• “The new HR platform must support Two-Factor Authentication (2FA).”
• “The marketing list must be stored in the EU (for GDPR).”

Step 3: The “Go/No-Go” Gate

This is the most critical step. Before you flip the switch to go live, someone must verify that the requirements from Step 2 were actually met.

In a small business, this might just be the CEO or the IT Lead testing the system. If it doesn’t pass, you don’t launch. Document this decision. An email saying “Security checks passed, approved for launch” is valid audit evidence.

Handling “Agile” Projects

If you are a tech startup or run on Agile sprints, you don’t have distinct “phases.” That’s fine. You integrate Annex A 5.8 by:

• Tagging Tickets: Add a “Security Review” tag to any ticket that involves data or access changes.
• Definition of Done: Add a checklist item to your completion criteria: “Security implications reviewed.”

What the auditor will check

When the auditor comes knocking, they want to see that you didn’t just get lucky, they want to see a process. You should be prepared to show:

• A Project Management Policy: A short document stating that all projects must consider security risks.
• Project Risk Assessments: The notes from your “Kick-Off” checks.
• Testing Records: Proof that you tested the security before going live.

If you are staring at a blank page and don’t know how to write a Project Management Policy that fits a small business, Hightable.io is a lifesaver. Their ISO 27001 toolkits contain ready-made Project Initiation and Security Risk templates that are perfectly sized for smaller organizations, helping you look professional without the administrative bloat.

Common ISO 27001 Annex A 5.8 Mistakes SMEs Make and How to Avoid Them

Ignoring Non-IT Projects:
Don’t forget that moving offices or changing your shredding provider is also a project. Security isn’t just code; it’s physical access too.

Over-Complicating It:
Do not try to implement a PRINCE2 methodology for a 5-person company. Keep the process proportional to your size. A checklist is fine; a 50-page manual is not.

Fast Track ISO 27001 Annex A 5.8 Compliance for SMEs with the ISO 27001 Toolkit

For Small Businesses and SMEs, ISO 27001 Annex A 5.8 (Information security in project management) ensures that security is part of the conversation before you start building, buying, or changing things. Whether you are migrating to a new CRM or launching a website feature, this control prevents the “Oh no” moment after launch when you realise a new system is insecure. It is about building a habit of “measuring twice, cutting once”.

While SaaS compliance platforms often try to sell you “integrated project workflows” or complex “security-by-design modules”, they cannot actually perform a “Kick-Off” risk check for your unique initiatives or decide if a “Go/No-Go” gate has been passed. Those are human governance and operational tasks. The High Table ISO 27001 Toolkit is the logical choice for SMEs because it provides the project framework you need without a recurring subscription fee.

1. Ownership: You Own Your Project Security Procedures Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your project security rules and store your risk checks inside their proprietary system, you are essentially renting your own operational intelligence.

• The Toolkit Advantage: You receive the Project Management Policy and Project Risk Assessment Templates in fully editable Word and Excel formats. These files are yours forever. You maintain permanent ownership of your records, such as your specific history of project “Go/No-Go” decisions, ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance Without the Administrative Bloat

Annex A 5.8 is about integrating security into change. You do not need a complex new software interface to manage what a simple 3-step checklist or a tagged ticket in Jira already does perfectly.

• The Toolkit Advantage: SMEs need processes that do not slow down growth. What they need is the governance layer to prove to an auditor that security implications are reviewed for every project. The Toolkit provides pre-written “Kick-Off Risk Checks” and “Testing Records” that formalise your existing agile or manual work into an auditor-ready framework, without forcing your team to learn a new software platform just to log a security check.

3. Cost: A One-Off Fee vs. The “Project” Tax

Many compliance SaaS platforms charge more based on the number of “active projects”, “assigned tasks”, or “remediation workflows”. For an SME, these monthly costs can scale aggressively for very little added value.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you run 2 projects a year or 20, the cost of your Project Security Documentation remains the same. You save your budget for actual business development rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Change Strategy

SaaS tools often mandate specific ways to report on and monitor “project security”. If their system does not match your unique business model or specialized industry requirements, such as moving to a new physical office or hiring a niche contractor, the tool becomes a bottleneck to efficiency.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Project Procedures to match exactly how you operate, whether you use formal PRINCE2-style methods or lean, collaborative agile sprints. You maintain total freedom to evolve your change strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For SMEs, the auditor wants to see that you didn’t just get lucky with security, they want to see a process (e.g. project risk assessments and testing records). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

Conclusion

ISO 27001 Annex A 5.8 is about building a habit of “measuring twice, cutting once.” By taking five minutes at the start of a project to ask about security risks, you protect your small business from the kind of mistakes that could put you out of business. Keep it simple, document your decisions, and use the templates at Hightable.io to get it right the first time.