ISO 27001 Annex A 5.8 Information security in project management
What it says
Information security shall be integrated into project management.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInclude security checks in all projects to prevent risks from new systems.
This control is about making sure that every project considers information security right from the start. If you overlook security in projects, you might end up with new systems or processes that put your organisation at risk of data breaches or downtime.
Free. Save your status, tasks and notes.
Why it matters
If security is not built into project plans and stage gates, releases may introduce vulnerabilities and rework, causing delays, cost overruns and incidents.
How to implement
Project Managers should include information security in the initial project planning.
This means thinking about what kind of information the project will handle and what security it needs. They can do this by consulting with an IT manager or security expert to set clear security goals and methods for the project.
IT Managers should assess and identify security risks at the start of the project.
This involves evaluating what could go wrong in using new systems or procedures and finding ways to prevent those issues. Follow the Australian Privacy Act 1988 and other relevant guidance to ensure compliance.
Security Officers should ensure that everyone involved in the project understands the security requirements.
They can organise training sessions to educate team members about their security responsibilities and how to protect sensitive data.
Project Steering Committees need to monitor the project's security aspects throughout its life cycle.
They should schedule regular reviews to check that security measures are on track and working as expected. This might involve testing systems for vulnerabilities or checking logs for signs of unusual activity.
Legal and Compliance Teams should verify that the project meets legal and regulatory requirements.
They can do this by reviewing contracts, policies, and activities to ensure all security aspects align with laws such as the OAIC guidelines.
Keep it running
Define security requirements early, include security deliverables in stage gates (design, build, test, go-live), and track risks/issues in the project register.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the project's initial security risk assessment documents.
Look at
Check that the assessment includes identification and analysis of potential risks with proposed mitigation strategies.
Good evidence
A comprehensive risk assessment document that identifies risks, analyses their impact, and includes a clear action plan to manage them.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of any security training provided to the project team.
Look at
Verify that the training includes guidance on information protection and specific security responsibilities.
Good evidence
Training records that show regular and relevant security training, tailored to the project's context and involving all necessary personnel.
- Check 3 of 5What an auditor asks for
Ask for
Request documentation of regular security review meetings or audits.
Look at
Ensure there are notes and action items that address security issues or improvements.
Good evidence
Minutes from meetings that show continuous evaluation of security measures and actions taken to address any identified concerns.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about security requirements included in project specifications.
Look at
Ensure these requirements align with organisational security policies and standards.
Good evidence
Detailed project requirements that incorporate security needs from organisational policies and relevant regulations.
- Check 5 of 5What an auditor asks for
Ask for
Request any security incident reports related to the project.
Look at
Examine how incidents were documented, investigated, and resolved.
Good evidence
Comprehensive incident reports showing prompt and effective response and learnings applied to prevent future occurrences.
Mappings
Closest match in ASD Information Security Manual: ISM-0597, Consult ASD before changing CDS connectivity, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.2.
Annex A 6.2.2 (ISO/IEC 42001:2023) requires the organisation to specify and document requirements for new AI systems or material enhancements to existing systems. Annex A 5.8 (ISO/IEC 27001:2022) requires integrating information security into project management processes, including defining security requirements as part of project deliverables. They overlap where AI system requirements include information security aspects managed through project processes, although Annex A 6.2.2 has a specific focus on AI systems.
ASD Information Security Manual: 6 mappings
This control is broader than ISM-0597.
Annex A 5.8 requires information security to be integrated into project management, including planning and design decisions that affect security posture. ISM-0597 relates by requiring ASD consultation when planning, designing, implementing or introducing additional connectivity to CDSs, which is a specific security gate within certain projects. Annex A 5.8 is broader because it applies across all projects, while ISM-0597 is limited to CDS connectivity changes and an external consultation obligation.
This control is broader than ISM-1790.
Annex A 5.8 requires information security to be integrated into project management so security requirements and checks are applied when delivering new or changed capabilities. ISM-1790 relates by requiring the integrity of delivered operating systems, applications, equipment and services, which is a specific security requirement often managed within procurement and delivery phases of projects. Annex A 5.8 is broader because it covers integrating security across all project activities, not only delivery integrity and supply/chain-of-custody considerations.
This control is broader than ISM-2033.
Annex A 5.8 requires information security to be integrated into project management so security is considered and checked throughout project delivery. ISM-2033 relates by mandating that software security requirements are documented, stored securely and maintained across the SDLC, which is a concrete project/engineering activity that should be embedded in project governance. Annex A 5.8 is broader because it applies to all project types and security integration activities, not only software security requirements management.
This control is broader than ISM-2084.
Annex A 5.8 requires information security to be integrated into project management so project delivery considers security risks and controls. ISM-2084 relates by requiring AI model/system documentation (e.g. model/system cards) to capture characteristics, architectures, use cases and security risks, which is a project artefact that supports secure AI delivery. Annex A 5.8 is broader because it applies to all projects, whereas ISM-2084 is specific to AI systems and documentation of AI-specific risks.
This control partially meets ISM-1998.
ISM-1998 requires executive leadership to ensure cyber security is integrated throughout all business functions within the organisation. ISO/IEC 27001:2022 Annex A 5.8 is one concrete area of that integration, requiring information security to be embedded specifically into project management activities. ISM-1998 is broader because it covers all functions (including but not limited to projects), while Annex A 5.8 is limited to the project management context.
This control partially overlaps ISM-1203.
ISM-1203 requires system owners and authorising officers to conduct a threat and risk assessment for each system. Annex A 5.8 (Information security in project management) supports ISM-1203 by ensuring risk assessment activities are embedded into project delivery (e.g. new systems, major changes) so that threats/risks are assessed at appropriate points. Annex A 5.8 is broader across project governance, while ISM-1203 is specifically about conducting the system threat and risk assessment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.