ISO 27001 A.8.26: Application security requirements

Set up a process that triggers security requirements gathering at the start of every application project, whether you are building or buying. Create a security requirements template that covers common areas and can be tailored per project.

The core categories to address: authentication (MFA support, SSO integration, password policy enforcement), authorisation (RBAC, fine-grained permissions, API authorisation), data protection (encryption at rest and in transit, data masking, secure key management), input validation (server-side validation, parameterised queries, content security policies), session management (secure tokens, timeout, anti-CSRF), error handling (no information leakage in error messages), logging (security events, audit trails, log integrity), API security (authentication, rate limiting, input validation), and compliance (regulatory requirements, data residency).

For internal development, integrate security requirements into your standard requirements process. Use threat modelling to surface additional requirements specific to the application context. Make sure security requirements appear in acceptance criteria and get validated during testing.

For acquired applications, put security requirements in the RFP and evaluation criteria. Assess candidates through vendor security questionnaires, product security documentation, security testing of trial instances, and review of certifications and audit reports.

Before any application goes live, validate that security requirements are actually met. Run SAST, DAST, and penetration testing to verify implementation. Document results and any accepted residual risks. Include security sign-off in the go-live approval.

Build a reusable library of security requirements organised by application type and risk level. Update it as standards, threats, and regulations evolve. This saves time on each new project while keeping things consistent.