ISO 27001:2022 Annex A Control 5.8

The Importance of Information Security in Project Management

The increasing number of businesses conducting their activities online has elevated the importance of information security in project management. As a result, project managers face a growing number of employees working outside the office and using their personal devices for work.

Creating a security policy for your business will allow you to minimise the risk of a breach or data loss. In addition, you will be able to produce accurate reports on project status and finances at any given time.

As part of the project planning and execution process, information security should be included in the following ways:

• Define the information security requirements for the project, taking into account business needs and legal requirements.
• Information security threats should be assessed in terms of their risk impact.
• To manage risk impacts, implement appropriate controls and processes.
• Ensure that these controls are monitored and reported regularly.

The key to keeping your business projects secure is ensuring that your project managers understand the importance of information security and adhere to it in their duties.

How to Meet the Requirements and What Is Involved

Integration of information security into project management is essential since it allows organisations to identify, evaluate, and address security risks.

Consider the example of an organisation implementing a more sophisticated product development system.

A newly developed product development system can be assessed for information security risks, including unauthorised disclosure of proprietary company information. Steps can be taken to mitigate these risks.

To comply with the revised ISO 27001:2022, the information security manager should collaborate with the project manager to identify, assess, and address information security risks as part of the project management process to meet the requirements of the revised ISO 27001:2022. Project management should integrate information security so that it is not something done “to” the project but something that is “part of the project”.

According to Annex, A control 5.8, the project management system should require the following:

• Information security risks are assessed and addressed early and periodically throughout the project’s life cycle.
• Security requirements must be addressed early in the project development process, for example, application security requirements (8.26), requirements for complying with intellectual property rights (5.32), etc.
• As part of the project life cycle, information security risks associated with project execution are considered and addressed. These include the security of internal and external communication channels.
• An evaluation and testing of the effectiveness of the treatment of information security risks are conducted.

All projects, regardless of their complexity, size, duration, discipline or application area, including ICT development projects, should be evaluated for information security requirements by the Project Manager (PM). Information security managers should understand the Information Security Policy and related procedures and the importance of information security.

The revised ISO 27001:2022 contains more details regarding the implementation guidelines.

What Are the Changes and Differences From ISO 27001:2013?

In ISO 27001:2022, the implementation guidance for Information Security in Project Management has been revised to reflect more clarifications than in ISO 27001:2013. According to ISO 27001:2013, every project manager should know three points related to information security. However, this has been expanded to four points in ISO 27001:2022.

Control 5.8 in Annex A of ISO 27001:2022 is not new but a combination of controls 6.1.5 and 14.1.1 in ISO 27001:2013.

Information security-related requirements for newly developed or enhanced information systems are discussed in Annex A Control 14.1.1 of ISO 27001:2013.

Annex A control 14.1.1 implementation guidelines are similar to control 5.8, which deals with ensuring that the architecture and design of information systems are protected against known threats within the operating environment.

Despite not being a new control, Annex A Control 5.8 brings some significant changes to the standard. Furthermore, combining the two controls makes the standard more user-friendly.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

Who Is in Charge of ISO 27001:2022 Annex A 5.8?

To ensure information security is implemented throughout the life cycle of each project, the Project Manager is responsible.

Nevertheless, the PM may find it helpful to consult with an Information Security Officer (ISO) to determine which information security requirements are needed for each project.

How ISMS.online Helps

Using ISMS.online, you can manage your information security risk management processes efficiently and effectively.

Through the ISMS.online platform, you can access various powerful tools designed to simplify the process of documenting, implementing, maintaining, and improving your information security management system (ISMS) and achieving compliance with ISO 27001.

It is possible to create a bespoke set of policies and procedures using the comprehensive package of tools provided by the company. These policies and practices will be tailored to meet your organisation’s specific risks and needs. Moreover, our platform allows collaboration between colleagues and external partners, including suppliers and third-party auditors.

In addition to DPIA and other related personal data assessments, e.g. Legitimate Interest Assessments (LIAs), ISMS.online provides simple, practical frameworks and templates for the security of information in project management.

To schedule a demo, please get in touch with us today.