ISO 27001 Annex A 5.8 Information Security In Project Management

Home / ISO 27001 Annex A Controls / ISO 27001 Annex A 5.8 Information Security In Project Management

ISO 27001 Information Security In Project Management

I am going to show you what ISO 27001 Annex A 5.8 Information Security In Project Management is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is it?

ISO 27001 Annex A 5.8 Information security in project management is an ISO 27001 control that requires information security to be integrated into project management.

You will be following a project management methodology and that process will include information security requirements as part of it.

Purpose

Annex A 5.8 is a preventive control that ensures information security risks related to projects and deliverables are effectively addressed in project management throughout the project life cycle.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.8 as:

Information security should be integrated into project management.

ISO 27001:2022 Annex A 5.8 Information security in project management

DO IT YOURSELF ISO 27001

STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS

ISO 27001 Toolkit Business Edition

Implementation Guide

You are going to be doing some level of project management following your approach and methodology. This is fine. There are many approaches and methodologies, but what ever you do, you will integrate information security ensuring information security risks are addressed as part of the process. You can consider ISO 21500 and ISO 21502 for guidance on concepts and processes for project management.

You are going to have to ensure that

  • you have identified, assessed and treated information security risks at an early stage
  • you continue to identify, assess and treat risks at points in the project lifecycle
  • requirements for information security and intellectual property are addressed early in projects
  • risks associated with the execution of projects are considered and treated
  • progress on risk treatment is reviewed and its effectiveness evaluated and treated

Your project steering committee or oversight structure is going to check the appropriateness of the information security considerations and activities. The project is going to have roles and responsibilities for information security defined and allocated.

What to consider when determining requirements

  • The information that is involved and the information security needs for that information. This would include considering the negative impacts of not having the security controls
  • The protection requirements for information and the assets that process, store and transmit it
  • Authentication requirements for access to information and the assets that process, store and transmit it
  • The processes for providing the access for both customers and business users
  • Informing users of their duties and responsibilities
  • Compliance to the legal, regulatory and client requirements for information security

How to determine information security requirements

You can determine the requirements for information security in a project using a variety of methods. Some examples would be:

  • What are the compliance requirements set in our policies
  • What do regulations say about information security
  • What laws apply and what requirements do they set
  • Considering threat modelling, threat intelligence and actual incidents that have been experienced

Templates

If you are considering a fast track to ISO 27001 certification and are wanting to take the Do It Yourself approach then take a look at the most compressive ISO 27001 Toolkit on the market.

DO IT YOURSELF ISO 27001

STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS

ISO 27001 Toolkit Business Edition

How to comply

To comply with ISO 27001 Annex A 5.8 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

  • Establish and document your project methodology
  • Include steps to identify, assess and treat information security risks at an early stage
  • Continue to identify, assess and treat risks at points in the project lifecycle
  • Demonstrate the requirements for information security and intellectual property are addressed early in projects
  • Document that risks associated with the execution of projects are considered and treated
  • Monitor progress on risk treatment and review its effectiveness, that is evaluated and treated

How to pass an audit

To pass an audit of ISO 27001 Annex 5.8 Information security in project management you are going to make sure that you have followed the steps above in how to comply.

You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have a documented project management process

What ever your approach to projects the process is going to be written down.

2. That you have followed and can evidence you project management process

You have the process, you have included the requirements of the standard and you can evidence that you have followed it at least once or consistently since implementing it, which ever is the greater.

3. That risks are managed

That you have evidence of managing risks which includes for the project that you have identified, assessed and treated them.

Top 3 Mistakes People Make

The top 3 Mistakes People Make For ISO 27001 Annex A 5.8 Information security in project management are

1. You haven’t got a written project process and / or you are not following it

Make sure your process is documented and that you have evidence that you follow it.

2. You didn’t manage risks

Do not overlook risk management in your project management process. Evidence that you have identified, assessed and treated the appropriate project risks for information security.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 5.8 FAQ

Why is information security important in project management?

Information security is important in project management to make sure that any information security risks are identified, assessed and treated as early as possible. The sooner we manage risk the less problems we will have. It will reduce costs and rework and ensure that we are meeting the information security requirements of clients, customers, the law and regulators.

Why is ISO 27001 Annex A 5.8 Important?

The purpose of this control is to implement information security by design and default. It can be easy to overlook information security in the rush to release products and services especially if there is a commercial cost to doing so. Getting it right early in the process will vastly reduce rework and vastly reduce the risk of data or legal breach.

What is information security in project management?

Information security in project management is ensuring the project management methodology has key steps for the identification, assessment and management of information security risks.

What should be included in a project plan for information security?

The project plan should include the identification of information security requirements early in the process. It should include the identification, assessment and management of information security risks. It will include the allocation of information security roles to the team. Testing and security testing will form part of the project plan.

What clause of ISO 27001 covers information security in project management?

ISO 27001 annex A 5.8 covers information security in project management.

What clause of ISO 27002 covers threat intelligence?

ISO 27002 clause 5.8 covers information security in project management.

What is the difference between ISO 27001 annex A 5.8 and ISO 27002 clause 5.8?

Nothing, they are the same thing. ISO 27002 is a standard in its own right and is included as an Annex to the ISO 27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.

How long will ISO 27001 Annex A 5.8 information security in project management take me?

It will take you up to a week to define and write your project management methodology. The amount of time per project is going to be dependant on the size and complexity of the project.

How much will ISO 27001 Annex A 5.8 information security in project management cost me?

The costs can be substation but are clearly related directly to the actual project you are delivering, the risks identified and the treatments that you put in place.

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Controls and Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
PreventiveConfidentialityIdentifyGovernanceGovernance and Ecosystem
IntegrityProtectProtection
Availability
ISO 27001 Toolkit Business Edition

Do It Yourself ISO27001

Stop Spanking £10,000s on consultants and ISMS online-tools.