Key takeaways
- Establish and apply principles for engineering secure systems.
- Good architecture principles reduce whole classes of vulnerability.
- Start here: document secure engineering principles such as least privilege and defence in depth.
Purpose
Establish and apply principles for engineering secure systems.
Requirement
Requirement summaryPrinciples for engineering secure systems shall be established, documented, maintained and applied to any information system development activities.
Why it matters
Good architecture principles reduce whole classes of vulnerability.
How to implement
- Document secure engineering principles such as least privilege and defence in depth.
- Apply them in system design.
- Review designs against them.
- Update principles as technology changes.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.27. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your secure design principles (for example least privilege and defence in depth).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.27 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Design documents showing the principles were applied.
- Records of security design reviews.
- Proof the principles are reviewed and updated.
Things you should be able to show or explain
- Architects or senior developers should be able to explain the principles.
How much to show: One or two designs.
Common mistakes
- No principles written down.
- Designs never reviewed for security.
- Principles written but not used in design reviews.
- Ignoring them for internal tools.
- Tip: Document principles like defence-in-depth and zero trust.
Policies & documents to have
- Secure Development Policy
FAQ
Is A.8.27 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.27?
Be ready to explain how the control works in your organisation and to provide things like: Your secure design principles (for example least privilege and defence in depth)…