ISO27001 Annex A 5.8 Information security in project management Beginner’s Guide

Share with your network

ISO27002: 2022 Clause 5.8 Information security in project management

In this article I lay bare ISO27001:2022 Annex A 5.8 / ISO27002:2022 Clause 5.8 Information security in project management. A beginners guide, exposing the insider trade secrets, giving you the templates that will save you hours of your life and showing you exactly what you need to do to satisfy it for ISO27001 certification. We show you exactly what changed in the ISO27001:2022 update. I am Stuart Barker the ISO27001 Ninja and this is ISO27001 Annex A 5.8.

What is ISO27001 Annex A 5.8 Information security in project management?

ISO27001 Annex A 5.8 Information security in project management is an ISO27002:2022 control that requires information security to be integrated into project management.

You will be following a project management methodology and that process will include information security requirements as part of it.

ISO27001 Annex A 5.8 Definition

The ISO27001 standard defines ISO27001 Annex A 5.8 Information security in project management as:

Information security should be integrated into project management.

ISO27001 Annex A 5.8 Information security in project management

ISO27001 Annex A 5.8 Guide

You are going to be doing some level of project management following your approach and methodology. This is fine. There are many approaches and methodologies, but what ever you do, you will integrate information security ensuring information security risks are addressed as part of the process. You can consider ISO 21500 and ISO 21502 for guidance on concepts and processes for project management.

You are going to have to ensure that:

  • you have identified, assessed and treated information security risks at an early stage
  • you continue to identify, assess and treat risks at points in the project lifecycle
  • requirements for information security and intellectual property are addressed early in projects
  • risks associated with the execution of projects are considered and treated
  • progress on risk treatment is reviewed and its effectiveness evaluated and treated

Your project steering committee or oversight structure is going to check the appropriateness of the information security considerations and activities. The project is going to have roles and responsibilities for information security defined and allocated.

What to consider when determining requirements

  • The information that is involved and the information security needs for that information. This would include considering the negative impacts of not having the security controls
  • The protection requirements for information and the assets that process, store and transmit it
  • Authentication requirements for access to information and the assets that process, store and transmit it
  • The processes for providing the access for both customers and business users
  • Informing users of their duties and responsibilities
  • Compliance to the legal, regulatory and client requirements for information security

How to determine information security requirements

You can determine the requirements for information security in a project using a variety of methods. Some examples would be:

  • What are the compliance requirements set in our policies
  • What do regulations say about information security
  • What laws apply and what requirements do they set
  • Considering threat modelling, threat intelligence and actual incidents that have been experienced

ISO27001 Annex A 5.8 Templates

You can save months of effort with these templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

ISO 27001 Templates Toolkit Business Edition Black

How to comply with ISO27001 Annex 5.8

To comply with ISO27001 Annex A 5.8 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

  • Establish and document your project methodology
  • Include steps to identify, assess and treat information security risks at an early stage
  • Continue to identify, assess and treat risks at points in the project lifecycle
  • Demonstrate the requirements for information security and intellectual property are addressed early in projects
  • Document that risks associated with the execution of projects are considered and treated
  • Monitor progress on risk treatment and review its effectiveness, that is evaluated and treated

How to pass an audit of ISO27001 Annex 5.8

To pass an audit of ISO27001 Annex 5.8 Information security in project management you are going to make sure that you have followed the steps above in how to comply.

You are going to do that by first conducting an internal audit, following the How to Conduct an ISO27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through the main ones

#1 That you have a documented project management process

What ever your approach to projects the process is going to be written down.

#2 That you have followed and can evidence you project management process

You have the process, you have included the requirements of the standard and you can evidence that you have followed it at least once or consistently since implementing it, which ever is the greater.

#3 That risks are managed

That you have evidence of managing risks which includes for the project that you have identified, assessed and treated them.

Top 3 Mistakes People Make in ISO27001 5.8

The top 3 Mistakes People Make For ISO27001 Annex A 5.8 Information security in project management are

#1 You haven’t got a written project process and / or you are not following it

Make sure your process is documented and that you have evidence that you follow it.

#2 You didn’t manage risks

Do not overlook risk management in your project management process. Evidence that you have identified, assessed and treated the appropriate project risks for information security.

#3 Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Why is ISO27001 Annex A 5.8 Important?

The purpose of this control is to implement information security by design and default. It can be easy to overlook information security in the rush to release products and services especially if there is a commercial cost to doing so. Getting it right early in the process will vastly reduce rework and vastly reduce the risk of data or legal breach.

ISO27001 Annex A 5.8 FAQ

Why is information security important in project management?

Information security is important in project management to make sure that any information security risks are identified, assessed and treated as early as possible. The sooner we manage risk the less problems we will have. It will reduce costs and rework and ensure that we are meeting the information security requirements of clients, customers, the law and regulators.

What is information security in project management?

Information security in project management is ensuring the project management methodology has key steps for the identification, assessment and management of information security risks.

What should be included in a project plan for information security?

The project plan should include the identification of information security requirements early in the process. It should include the identification, assessment and management of information security risks. It will include the allocation of information security roles to the team. Testing and security testing will form part of the project plan.

What clause of ISO27001 covers information security in project management?

ISO27001:2022 annex A 5.8 covers information security in project management.

What clause of ISO27002 covers threat intelligence?

ISO27002:2022 clause 5.8 covers information security in project management.

What is the difference between ISO27001 annex A 5.8 and ISO27002 clause 5.8?

Nothing, they are the same thing. ISO27002 is a standard in its own right and is included as an Annex to the ISO27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.

How long will ISO27001 Annex A 5.8 information security in project management take me?

It will take you up to a week to define and write your project management methodology. The amount of time per project is going to be dependant on the size and complexity of the project.

How much will ISO27001 Annex A 5.8 information security in project management cost me?

The costs can be substation but are clearly related directly to the actual project you are delivering, the risks identified and the treatments that you put in place.

Matrix of controls and attribute values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
#Preventive

#Confidentiality
#Integrity
#Availability
#Identify
#Protect
#Governance
#Governance_
and_Ecosystem

#Protection

See Also

Reference

ISO/IEC 27001 Information Security Management

Share with your network
ISO 27001 Templates Toolkit Business Edition Black
ISO27001 Policy Templates Pack Green
Free ISO27001 Strategy Call
Shopping Cart