Information security in project management
Purpose
Make sure security risks tied to projects and their deliverables are handled throughout the project life cycle.
How to meet this control
In short: Integrate security into project management regardless of project type.
- Step 01Add a mandatory security gate to the project lifecycle so projects cannot pass kickoff or go-live without a security checklist being completed
- Step 02Require a risk assessment at project initiation and at major stage gates, with treatment actions tracked to closure
- Step 03Capture security and privacy requirements (classification, access, data residency, IP) in the project brief before design begins
- Step 04Name a security responsibility for each project, whether the project lead or an assigned security contact
- Step 05Have the steering committee or project board formally review security status at defined milestones
Tip: Add a security checklist gate to your project/SDLC kickoff.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Integrate security into project management for all project types, not just IT projects
- ›Assess and treat security risks early and at regular points through the project
- ›Address security requirements, including application and intellectual property needs, in the early stages
- ›Consider risks from internal and external communications during project execution
- ›Review progress on risk treatment and test that the treatments are effective
- ›Define and assign security roles and authorities for each project
- ›Have a governance body or steering committee check security activities at set milestones
- ›Determine protection needs by considering classification, access provisioning and legal obligations
Audit evidence to keep
- - Project management methodology or template showing a mandatory security gate or checklist
- - Completed project security risk assessments with tracked treatment actions
- - Project documentation capturing security and privacy requirements
- - Steering committee or milestone records evidencing security review
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.8. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.