Secure system architecture and engineering principles
Purpose
Establish, document and apply secure engineering principles across all information system development.
How to meet this control
In short: Establish and apply secure engineering principles.
- Step 01Document secure engineering principles such as defence in depth, least privilege, default deny and zero trust, and apply them to every architecture layer
- Step 02Run threat modelling and security design reviews for new systems and significant changes
- Step 03Review designs against known attack patterns and harden systems, documenting any accepted gaps
- Step 04Authenticate every requester and validate authorisation using context, assuming breach rather than implicit trust
- Step 05Encrypt data end to end and segment systems so a compromise in one layer is contained
- Step 06Extend the principles to outsourced development and review them as technology evolves
Tip: Document principles (defence in depth, least privilege) and review designs against them.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Document engineering principles and design security into every architecture layer
- ›Analyse new technology for security risks and review designs against known attack patterns
- ›Identify the security controls needed and where and how to apply them
- ›Use principles such as security by design, defence in depth, default deny and least privilege
- ›Run security-oriented design reviews and harden systems, documenting any gaps
- ›Apply zero trust ideas: assume breach, never trust and always verify, and encrypt end-to-end
- ›Always authenticate requesters and validate authorisation using context
- ›Extend these principles to outsourced development and review them regularly
Audit evidence to keep
- - Documented secure engineering or architecture principles
- - Threat model or security design review for a recent system
- - Evidence of design review against attack patterns
- - Architecture showing zero trust or defence-in-depth controls
- - Review record confirming principles applied to outsourced work
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.8.27. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.