The ultimate audit guide to ISO 27001 Annex A 8.26 Application Security Requirements
Table of contents
- 1. Verify the Information Security Requirements Formalisation
- 2. Confirm Authentication and Access Control Requirements
- 3. Validate Data Input Sanitisation and Validation
- 4. Verify Cryptographic Protection Requirements
- 5. Confirm Application Logging and Audit Trail Requirements
- 6. Validate Error Handling and Information Leakage Prevention
- 7. Check the Secure Session Management Implementation
- 8. Ensure Supply Chain and Third-Party Component Security
- 9. Validate Availability and Resilience Requirements
- 10. Evidence that Security Testing and Certification Records are Present
1. Verify the Information Security Requirements Formalisation
Verification Criteria: Specific security requirements for applications are documented and approved during the initial specification and design phases.
Required Evidence: Software Requirement Specifications (SRS) or Design Documents containing explicit security-functional and non-functional requirements.
Pass/Fail Test: If an application was developed or procured without a formalised list of security requirements (e.g., encryption, session handling), mark as Non-Compliant.
2. Confirm Authentication and Access Control Requirements
Verification Criteria: Requirements for robust authentication (including MFA) and granular role-based access control (RBAC) are defined for all application user tiers.
Required Evidence: Application architecture diagrams or access control matrices specifying required login factors and permission levels.
Pass/Fail Test: If the application design allows for single-factor authentication for administrative functions or lacks granular permission logic, mark as Non-Compliant.
3. Validate Data Input Sanitisation and Validation
Verification Criteria: Technical requirements for the validation and sanitisation of all user-supplied data are documented to prevent common injection attacks.
Required Evidence: Secure Coding Standard or API Documentation specifying input validation parameters and regex filters.
Pass/Fail Test: If there is no documented requirement for input sanitisation (e.g., against SQLi or XSS) in the application design, mark as Non-Compliant.
ISO 27001 Toolkit
All the templates, tools, support and knowledge you need to do it yourself.
4. Verify Cryptographic Protection Requirements
Verification Criteria: Requirements for protecting sensitive data at rest and in transit within the application are defined, specifying algorithms and key management rules.
Required Evidence: Data Classification Policy and Application Security Design documents citing TLS versions and AES-256 (or equivalent) standards.
Pass/Fail Test: If the application design does not specify the encryption protocols for sensitive data fields or database volumes, mark as Non-Compliant.
5. Confirm Application Logging and Audit Trail Requirements
Verification Criteria: Requirements for generating, protecting, and reviewing application-level audit logs are explicitly defined.
Required Evidence: Logging Standard or Technical Specification identifying mandatory event types to be logged (e.g., login failure, data modification).
Pass/Fail Test: If the application is incapable of logging user activity or if logging requirements were never specified, mark as Non-Compliant.
6. Validate Error Handling and Information Leakage Prevention
Verification Criteria: Requirements are defined to ensure that application error messages do not reveal sensitive system or technical information to end-users.
Required Evidence: UI/UX Design specs or Error Handling Procedures specifying generic user-facing messages vs. detailed internal logs.
Pass/Fail Test: If an application in production reveals stack traces, database versions, or server paths in public error messages, mark as Non-Compliant.
7. Check the Secure Session Management Implementation
Verification Criteria: Technical requirements for session timeouts, concurrent login limits, and secure token handling (e.g., HttpOnly/Secure flags) are documented.
Required Evidence: Web Application Firewall (WAF) configuration logs or session management policy documentation.
Pass/Fail Test: If session tokens are found in URL parameters or lack a mandatory expiration timeout in the application configuration, mark as Non-Compliant.
8. Ensure Supply Chain and Third-Party Component Security
Verification Criteria: Requirements exist to verify the security of integrated third-party components, APIs, and libraries used by the application.
Required Evidence: Software Bill of Materials (SBOM) or Third-Party Security Assessment reports for integrated services.
Pass/Fail Test: If the organisation cannot produce a list of third-party libraries used in the application or has no record of assessing their security, mark as Non-Compliant.
9. Validate Availability and Resilience Requirements
Verification Criteria: Technical requirements for high availability, backup frequency, and disaster recovery are defined for the application service.
Required Evidence: Business Continuity Plan (BCP) or Service Level Agreement (SLA) specifying target RTO and RPO for the application.
Pass/Fail Test: If an application identified as ‘Critical’ has no documented requirement for redundancy or failover testing, mark as Non-Compliant.
10. Evidence that Security Testing and Certification Records are Present
Verification Criteria: The application has undergone formal security testing (e.g., Pentest or DAST) to verify that the identified requirements have been met.
Required Evidence: Signed Vulnerability Assessment reports or Penetration Testing Remediation logs showing all critical findings closed.
Pass/Fail Test: If a production application has not undergone a security test in the last 12 months or since its last major release, mark as Non-Compliant.
About the author
