How to implement ISO 27001 Information Security In Project Management and Pass the Audit
Table of contents
ISO 27001 Information Security in Project Management
In this ultimate guide to ISO 27001 Annex A 5.8 Information Security In Project Management you will learn
- What is ISO 27001 information security in project management
- How to implement ISO 27001 Project Management
What is ISO 27001 Annex A 5.8?
ISO 27001 Annex A 5.8 Information security in project management is an ISO 27001 Annex A control that requires information security to be integrated into project management.
You will be following a project management methodology and that process will include information security requirements as part of it.
ISO 27001 Annex A 5.8 Purpose
The purpose of ISO 27001 Annex A 5.8 is to ensure information security risks related to projects and deliverables are effectively addressed in project management throughout the project life cycle.
ISO 27001 Annex A 5.8 Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.8 as:
Information security should be integrated into project management.
ISO 27001:2022 Annex A 5.8 Information security in project management
DO IT YOURSELF ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
Implementation Guide
You are going to be doing some level of project management following your approach and methodology. This is fine. There are many approaches and methodologies, but what ever you do, you will integrate information security ensuring information security risks are addressed as part of the process. You can consider ISO 21500 and ISO 21502 for guidance on concepts and processes for project management.
You are going to have to ensure that
- you have identified, assessed and treated information security risks at an early stage
- you continue to identify, assess and treat risks at points in the project lifecycle
- requirements for information security and intellectual property are addressed early in projects
- risks associated with the execution of projects are considered and treated
- progress on risk treatment is reviewed and its effectiveness evaluated and treated
Your project steering committee or oversight structure is going to check the appropriateness of the information security considerations and activities. The project is going to have roles and responsibilities for information security defined and allocated.
What to consider when determining requirements
- The information that is involved and the information security needs for that information. This would include considering the negative impacts of not having the security controls
- The protection requirements for information and the assets that process, store and transmit it
- Authentication requirements for access to information and the assets that process, store and transmit it
- The processes for providing the access for both customers and business users
- Informing users of their duties and responsibilities
- Compliance to the legal, regulatory and client requirements for information security
How to determine information security requirements
You can determine the requirements for information security in a project using a variety of methods. Some examples would be:
- What are the compliance requirements set in our policies
- What do regulations say about information security
- What laws apply and what requirements do they set
- Considering threat modelling, threat intelligence and actual incidents that have been experienced
Watch the Tutorial
Watch How to implement ISO 27001 Annex A 5.8 Information Security In Project Management
ISO 27001 Templates
If you are considering a fast track to ISO 27001 certification and are wanting to take the Do It Yourself approach then take a look at the most compressive ISO 27001 Toolkit on the market.
How to comply
To comply with ISO 27001 Annex A 5.8 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Establish and document your project methodology
- Include steps to identify, assess and treat information security risks at an early stage
- Continue to identify, assess and treat risks at points in the project lifecycle
- Demonstrate the requirements for information security and intellectual property are addressed early in projects
- Document that risks associated with the execution of projects are considered and treated
- Monitor progress on risk treatment and review its effectiveness, that is evaluated and treated
How to pass the audit
To pass an audit of ISO 27001 Annex 5.8 Information security in project management you are going to make sure that you have followed the steps above in how to comply.
What will an audit check?
The audit is going to check a number of areas. Lets go through the main ones
1. That you have a documented project management process
What ever your approach to projects the process is going to be written down.
2. That you have followed and can evidence you project management process
You have the process, you have included the requirements of the standard and you can evidence that you have followed it at least once or consistently since implementing it, which ever is the greater.
3. That risks are managed
That you have evidence of managing risks which includes for the project that you have identified, assessed and treated them.
Top 3 Mistakes People Make
The top 3 Mistakes People Make For ISO 27001 Annex A 5.8 Information security in project management are
1. You haven’t got a written project process and / or you are not following it
Make sure your process is documented and that you have evidence that you follow it.
2. You didn’t manage risks
Do not overlook risk management in your project management process. Evidence that you have identified, assessed and treated the appropriate project risks for information security.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Information Security in Project Management FAQ
Information security is important in project management to make sure that any information security risks are identified, assessed and treated as early as possible. The sooner we manage risk the less problems we will have. It will reduce costs and rework and ensure that we are meeting the information security requirements of clients, customers, the law and regulators.
The purpose of this control is to implement information security by design and default. It can be easy to overlook information security in the rush to release products and services especially if there is a commercial cost to doing so. Getting it right early in the process will vastly reduce rework and vastly reduce the risk of data or legal breach.
Information security in project management is ensuring the project management methodology has key steps for the identification, assessment and management of information security risks.
The project plan should include the identification of information security requirements early in the process. It should include the identification, assessment and management of information security risks. It will include the allocation of information security roles to the team. Testing and security testing will form part of the project plan.
ISO 27001 annex A 5.8 covers information security in project management.
Nothing, they are the same thing. ISO 27002 is a standard in its own right and is included as an Annex to the ISO 27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.
It will take you up to a week to define and write your project management methodology. The amount of time per project is going to be dependant on the size and complexity of the project.
The costs can be substation but are clearly related directly to the actual project you are delivering, the risks identified and the treatments that you put in place.
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Identify | Governance | Governance and Ecosystem |
| Integrity | Protect | Protection | ||
| Availability |