ISO 27001 A.5.8: Information security in project management
Bolting security on at the end of a project is expensive, disruptive, and often ineffective. This control is about baking security into your project management methodology from the start - regardless of whether it is an IT project, a business transformation, or a facilities move.
Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.
Requirement summary
Information security shall be integrated into project management.
Check the source wording and scope in ISO/IEC 27001:2022. The guidance below explains how to approach a review.
In Plain Language
In practice, this means security requirements get identified during planning, security risks are assessed alongside all other project risks, security activities appear in timelines and budgets, and security deliverables get reviewed at key milestones before the project moves forward.
Systems designed with security in mind from day one are dramatically cheaper and more effective than systems that need retrofitting after deployment. Auditors will specifically look for evidence that security was considered throughout the project lifecycle, not just tacked on before go-live.
How to Implement
Update your project management methodology to include mandatory security checkpoints at each phase. At a minimum: security requirements gathering during initiation, risk assessment during planning, design review during development, security testing before deployment, and formal sign-off before go-live.
Create a security requirements checklist that project managers must complete at the start of every project. Cover data classification, access requirements, regulatory obligations, integration with existing controls, and any new risks the project introduces. Use the results to determine how much security involvement the project needs.
Define security gate criteria for milestones. A project should not move from design to development without a security architecture review, and should not go live without security testing and a vulnerability assessment. Enforce these through your project governance process.
Make sure your security team is resourced to support projects. Assign security champions to high-risk projects, offer consultation for lower-risk ones, and maintain a library of security requirements and design patterns that project teams can reference.
Train your project managers on security basics and what the methodology requires of them. They need to know when to involve the security team, how to engage them, and what deliverables are expected at each stage. Include security criteria in project success metrics and post-implementation reviews.
Evidence to review
- Project management methodology documentation showing security integration points
- Security requirements checklists or questionnaires used in project initiation
- Records of security risk assessments conducted for recent projects
- Evidence of security gate reviews and sign-offs at project milestones
- Post-implementation security review reports for completed projects
Common Mistakes
- Security is treated as an afterthought and only considered late in the project lifecycle
- Project management methodology does not include security checkpoints or gates
- Security team is not consulted or resourced to participate in project activities
- No security risk assessment is conducted as part of project planning
- Security requirements are identified but not tracked through to implementation and testing
Related Controls Across Frameworks
| Framework | Control ID | Relationship |
|---|---|---|
| SOC 2 | SOC 2 CC8.1: Change Management - Changes to Infrastructure, Data, Software, and Procedures | Related |
| GDPR | GDPR Art.25: Data Protection by Design and by Default | Related |
| NIS2 | NIS2 Art.21(2)(a): Policies on Risk Analysis and Information System Security | Partial overlap |
Frequently Asked Questions
Does this apply to all projects or only IT projects?
How do we integrate security without slowing down agile projects?
Related Articles
Compliance Costs: Budgeting for DIY, Consulting and Software
Compare staff time, audit fees, consulting, software and remediation without treating different services as interchangeable.
Read article →ISO 27001 Certification Cost: Build a Budget from Your Scope
Separate certification fees, preparation, staff time and remediation. Learn what to include in a quote request and a first-year ISO 27001 budget.
Read article →How to Get ISO 27001 Certified: A Step-by-Step Guide
A practical walkthrough of the ISO 27001 certification process - from scoping to stage 2 audit. Covers timelines, costs, common mistakes, and what auditors actually look for.
Read article →Track ISO 27001 compliance in one place
Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.
Start Free AssessmentStart without an account · Sign up only to save