Table of contents
- ISO27002: 2022 Clause 5.8 Information security in project management
- What is ISO27001 Annex A 5.8 Information security in project management?
- ISO27001 Annex A 5.8 Definition
- ISO27001 Annex A 5.8 Guide
- ISO27001 Annex A 5.8 Templates
- How to comply with ISO27001 Annex 5.8
- How to pass an audit of ISO27001 Annex 5.8
- What will an audit check?
- Top 3 Mistakes People Make in ISO27001 5.8
- Why is ISO27001 Annex A 5.8 Important?
- ISO27001 Annex A 5.8 FAQ
- Matrix of controls and attribute values
- See Also
- Reference
ISO27002: 2022 Clause 5.8 Information security in project management
In this article I lay bare ISO27001:2022 Annex A 5.8 / ISO27002:2022 Clause 5.8 Information security in project management. A beginners guide, exposing the insider trade secrets, giving you the templates that will save you hours of your life and showing you exactly what you need to do to satisfy it for ISO27001 certification. We show you exactly what changed in the ISO27001:2022 update. I am Stuart Barker the ISO27001 Ninja and this is ISO27001 Annex A 5.8.
What is ISO27001 Annex A 5.8 Information security in project management?
ISO27001 Annex A 5.8 Information security in project management is an ISO27002:2022 control that requires information security to be integrated into project management.
You will be following a project management methodology and that process will include information security requirements as part of it.
ISO27001 Annex A 5.8 Definition
The ISO27001 standard defines ISO27001 Annex A 5.8 Information security in project management as:
Information security should be integrated into project management.
ISO27001 Annex A 5.8 Information security in project management
ISO27001 Annex A 5.8 Guide
You are going to be doing some level of project management following your approach and methodology. This is fine. There are many approaches and methodologies, but what ever you do, you will integrate information security ensuring information security risks are addressed as part of the process. You can consider ISO 21500 and ISO 21502 for guidance on concepts and processes for project management.
You are going to have to ensure that:
- you have identified, assessed and treated information security risks at an early stage
- you continue to identify, assess and treat risks at points in the project lifecycle
- requirements for information security and intellectual property are addressed early in projects
- risks associated with the execution of projects are considered and treated
- progress on risk treatment is reviewed and its effectiveness evaluated and treated
Your project steering committee or oversight structure is going to check the appropriateness of the information security considerations and activities. The project is going to have roles and responsibilities for information security defined and allocated.
What to consider when determining requirements
- The information that is involved and the information security needs for that information. This would include considering the negative impacts of not having the security controls
- The protection requirements for information and the assets that process, store and transmit it
- Authentication requirements for access to information and the assets that process, store and transmit it
- The processes for providing the access for both customers and business users
- Informing users of their duties and responsibilities
- Compliance to the legal, regulatory and client requirements for information security
How to determine information security requirements
You can determine the requirements for information security in a project using a variety of methods. Some examples would be:
- What are the compliance requirements set in our policies
- What do regulations say about information security
- What laws apply and what requirements do they set
- Considering threat modelling, threat intelligence and actual incidents that have been experienced
ISO27001 Annex A 5.8 Templates
You can save months of effort with these templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.
How to comply with ISO27001 Annex 5.8
To comply with ISO27001 Annex A 5.8 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Establish and document your project methodology
- Include steps to identify, assess and treat information security risks at an early stage
- Continue to identify, assess and treat risks at points in the project lifecycle
- Demonstrate the requirements for information security and intellectual property are addressed early in projects
- Document that risks associated with the execution of projects are considered and treated
- Monitor progress on risk treatment and review its effectiveness, that is evaluated and treated
How to pass an audit of ISO27001 Annex 5.8
To pass an audit of ISO27001 Annex 5.8 Information security in project management you are going to make sure that you have followed the steps above in how to comply.
You are going to do that by first conducting an internal audit, following the How to Conduct an ISO27001 Internal Audit Guide.
What will an audit check?
The audit is going to check a number of areas. Lets go through the main ones
#1 That you have a documented project management process
What ever your approach to projects the process is going to be written down.
#2 That you have followed and can evidence you project management process
You have the process, you have included the requirements of the standard and you can evidence that you have followed it at least once or consistently since implementing it, which ever is the greater.
#3 That risks are managed
That you have evidence of managing risks which includes for the project that you have identified, assessed and treated them.
Top 3 Mistakes People Make in ISO27001 5.8
The top 3 Mistakes People Make For ISO27001 Annex A 5.8 Information security in project management are
#1 You haven’t got a written project process and / or you are not following it
Make sure your process is documented and that you have evidence that you follow it.
#2 You didn’t manage risks
Do not overlook risk management in your project management process. Evidence that you have identified, assessed and treated the appropriate project risks for information security.
#3 Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Why is ISO27001 Annex A 5.8 Important?
The purpose of this control is to implement information security by design and default. It can be easy to overlook information security in the rush to release products and services especially if there is a commercial cost to doing so. Getting it right early in the process will vastly reduce rework and vastly reduce the risk of data or legal breach.
ISO27001 Annex A 5.8 FAQ
Information security is important in project management to make sure that any information security risks are identified, assessed and treated as early as possible. The sooner we manage risk the less problems we will have. It will reduce costs and rework and ensure that we are meeting the information security requirements of clients, customers, the law and regulators.
Information security in project management is ensuring the project management methodology has key steps for the identification, assessment and management of information security risks.
The project plan should include the identification of information security requirements early in the process. It should include the identification, assessment and management of information security risks. It will include the allocation of information security roles to the team. Testing and security testing will form part of the project plan.
ISO27001:2022 annex A 5.8 covers information security in project management.
ISO27002:2022 clause 5.8 covers information security in project management.
Nothing, they are the same thing. ISO27002 is a standard in its own right and is included as an Annex to the ISO27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.
It will take you up to a week to define and write your project management methodology. The amount of time per project is going to be dependant on the size and complexity of the project.
The costs can be substation but are clearly related directly to the actual project you are delivering, the risks identified and the treatments that you put in place.
Matrix of controls and attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| #Preventive | #Confidentiality #Integrity #Availability | #Identify #Protect | #Governance | #Governance_ and_Ecosystem #Protection |
See Also
- Guaranteed ISO27001 Certification up to 10x Faster and 30x Cheaper
- The Ultimate ISO27001 TOOLKIT so you can do it yourself
- ISO27001 Exposed: The facts you must know (Not knowing these could cost you $10,000s!)
- 25 Things You Must Know Before Going for ISO27001 Certification (Number 3 will blow your mind!)
- The Ultimate Reference Guide to ISO27001 Controls
Reference
ISO/IEC 27001 Information Security Management
FREE 30 minute ISO27001 strategy session.
Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO27001 certified up to 10x faster and 30x cheaper.
