Key takeaways
- Build security into every project from the start.
- Security bolted on at the end of a project is expensive and often skipped.
- Start here: add a security checkpoint to your project lifecycle (initiation, design, go-live).
Purpose
Build security into every project from the start.
Requirement
Requirement summaryInformation security shall be integrated into project management.
Why it matters
Security bolted on at the end of a project is expensive and often skipped. Building it into project management catches risks early.
How to implement
- Add a security checkpoint to your project lifecycle (initiation, design, go-live).
- Use a short checklist or risk assessment for each new project.
- Make someone accountable for security actions within each project.
- Keep records of the assessment and its outcomes in the project file.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.8. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your project process or templates showing security is considered at the start, during and before go-live.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.8 marked as used or not used, a short reason, and its current status.
Records and examples to show
- One or two recent projects with a completed security risk check or security requirements.
- Go-live sign-offs showing security actions were completed.
Things you should be able to show or explain
- A project manager should be able to explain how security is built into projects.
How much to show: Two or three projects started in the last year.
Common mistakes
- Projects launched with no security check.
- Security checklist exists but is left blank.
- Only applying it to IT projects when business projects also handle data.
- A checklist that exists but is never completed.
- Tip: Add a security checklist to your project kickoff template.
Policies & documents to have
- Risk Management Policy
FAQ
Is A.5.8 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.8?
Be ready to explain how the control works in your organisation and to provide things like: Your project process or templates showing security is considered at the start, during and before go-live…