ISO 27001 Annex A 8.27 Secure system architecture and engineering principles

This control partially overlaps A.6.2.3.

Annex A 6.2.3 involves documenting AI system design in relation to objectives and requirements. In contrast, Annex A 8.27 mandates secure architectural principles across all systems, which involves documenting design principles applicable to development. The documentation overlap exists although Annex A 8.27 is general to all systems.

This control is broader than ISM-0938.

ISM-0938 seeks vendors with commitment to Secure by Design/Secure by Default, like memory safety. ISO/IEC 27001:2022 Annex A 8.27 involves secure system architecture and engineering principles, which vendors should follow. Annex A 8.27 guides organisational engineering, whereas ISM-0938 targets vendor selection who apply such practices.

This control is broader than ISM-0971.

Annex A 8.27 requires secure architecture and engineering principles to be defined and applied across system development. ISM-0971 relates by prescribing a specific secure engineering standard (OWASP ASVS) for web application development, which operationalises parts of secure design and build principles. Annex A 8.27 remains broader as it applies to all systems and architecture/engineering principles beyond web app verification requirements.

This control is broader than ISM-1238.

Annex A 8.27 requires documented secure architecture and engineering principles to be applied during information system development. ISM-1238 relates by mandating threat modelling to support the software development lifecycle, which is a key secure engineering practice used to derive and validate architectural security requirements. ISM-1238 is narrower because it specifies one technique, whereas Annex A 8.27 requires a broader set of principles and their application.

This control is broader than ISM-1460.

ISM-1460 requires that when an organisation uses software-based isolation to share a physical server, the isolation mechanism comes from a vendor demonstrably committed to Secure by Design/Secure by Default, including secure programming and (preferably) memory-safe languages or practices. Annex A 8.27 requires organisations to establish and apply secure system architecture and engineering principles across information system development activities, which would include the engineering principles used to select and trust an isolation mechanism. ISM-1460 is more specific (virtual server isolation vendor assurance and memory-safety expectations), while Annex A 8.27 is broader and applies to overall system engineering rather than supplier product selection alone.

This control is broader than ISM-1798.

ISM-1798 requires producing and publishing secure configuration (hardening/loosening) guides as part of software development. Annex A 8.27 requires establishing and applying secure system architecture and engineering principles across development activities. Configuration guidance for secure deployment is one expression of applying engineering principles, but Annex A 8.27 is broader and covers architectural design and engineering practices well beyond producing consumer configuration guides.

This control is broader than ISM-1850.

Annex A 8.27 requires secure architecture and engineering principles to guide how systems are designed and built. ISM-1850 relates by mandating mitigation of OWASP Top 10 during web application development, which is a specific secure engineering outcome driven by secure design and coding principles. Annex A 8.27 is broader because it covers principles for all system architectures and engineering activities, not only web application vulnerability categories.

This control is broader than ISM-1885.

ISM-1885 requires implementation of specific emanation security measures as prescribed by ASD mitigation advice for systems. ISO/IEC 27001:2022 Annex A 8.27 sets broader secure architecture and engineering principles that would include designing for side-channel/emanation resistance where relevant. ISM-1885 is therefore a specific, domain-focused application of secure engineering principles rather than a general architecture control.

This control is broader than ISM-1917.

ISM-1917 states that new systems must support specific PQC and strong algorithms by 2030. ISO/IEC 27001:2022 Annex A 8.27 involves secure system architecture principles that could include cryptographic agility and long-term resilience. Annex A 8.27 is broad, while ISM-1917 specifically focuses on certain cryptographic algorithms and a timeline.

This control is broader than ISM-2031.

ISM-2031 requires organisations to implement secure build tools and ensure their security features are used to harden executables. ISO/IEC 27001:2022 Annex A 8.27 requires secure system architecture and engineering principles to be established and applied, which can include principles for secure build, reproducibility, and compiler-based mitigations. Annex A 8.27 is broader and higher-level across engineering practices, while ISM-2031 is a specific technical instantiation focused on build tooling and compiler/interpreter security features.

This control is broader than ISM-2034.

Annex A 8.27 requires organisations to establish, document, maintain, and apply secure system architecture and engineering principles across information system development activities. ISM-2034 directly aligns by requiring security design decisions to be documented and reviewed throughout the software development cycle, which is one concrete mechanism for applying and governing those principles. Annex A 8.27 is broader because it covers the full set of architectural/engineering principles and their ongoing application, not just design decision documentation and review.

This control is broader than ISM-2039.

ISM-2039 requires the software threat model to be reviewed throughout the SDLC to keep pace with design/implementation changes and the evolving threat environment. ISO/IEC 27001:2022 Annex A 8.27 requires secure system architecture and engineering principles to be established and maintained, and threat modelling review is a mechanism to validate those principles against current threats as the design evolves. Annex A 8.27 is broader because it addresses overall engineering principles and architecture governance beyond the specific activity of reviewing a threat model.

This control is broader than ISM-2043.

ISM-2043 requires software to be architected and structured to support readability and maintainability. ISO/IEC 27001:2022 Annex A 8.27 requires secure system architecture and engineering principles to be established and applied, which typically includes maintainable, well-structured designs as part of good engineering practice. Annex A 8.27 is broader because it focuses on security architecture principles overall (e.g. segregation, least privilege, threat modelling), whereas ISM-2043 focuses specifically on readability/maintainability outcomes.

This control is broader than ISM-2154.

ISM-2154 requires controlling third-party software composition by pinning dependencies to approved versions in source code. Annex A 8.27 requires secure system architecture and engineering principles to be established and applied, which can include supply chain integrity principles such as controlling external components and ensuring build reproducibility. Annex A 8.27 is higher-level engineering guidance, whereas ISM-2154 is a specific engineering control for dependency version control.

This control is broader than ISM-2158.

ISM-2158 requires architectural and runtime controls so that untrusted retrieved content cannot override system instructions, security policies, access controls, tool permissions, or human approvals. Annex A 8.27 requires establishing and applying secure system architecture and engineering principles, which is the broader mechanism that would drive design patterns like instruction/data separation, policy enforcement points, and least-privilege tool interfaces for agentic AI. ISM-2158 is a concrete architectural requirement within the wider secure engineering principles mandated by Annex A 8.27.

This control partially meets ISM-0401.

ISM-0401 encompasses Secure by Design from design to operational transition. ISO/IEC 27001:2022 Annex A 8.27 focuses on secure system architecture and engineering during system development. While Annex A 8.27 is integral to Secure by Design, ISM-0401 also includes implementation and verification.

This control partially overlaps ISM-1739.

ISM-1739 requires a system's security architecture to be approved prior to development. ISO/IEC 27001:2022 Annex A 8.27 requires establishing, maintaining, and applying secure architecture and engineering principles to development activities, directly informing what an approvable security architecture should encompass. Annex A 8.27 is broader as it concerns principles across developments, whereas ISM-1739 is specifically an approval requirement for a particular system's architecture before build starts.

This control partially overlaps ISM-1780.

Annex A 8.27 requires organisations to establish and apply secure system architecture and engineering principles for development activities. ISM-1780 overlaps by requiring SecDevOps practices, which are a delivery approach that embeds security controls and automation to implement secure engineering in practice. Annex A 8.27 focuses on defining and maintaining principles (what good looks like), while ISM-1780 focuses on adopting an operational practice model (how it is delivered), and either can exist without fully satisfying the other.

This control partially overlaps ISM-2033.

ISM-2033 requires software security requirements to be documented, stored securely, and maintained throughout the SDLC. This overlaps with Annex A 8.27 because documented and maintained secure engineering principles are commonly used to derive, refine, and keep security requirements consistent across design and build activities. Annex A 8.27 is about establishing and applying engineering principles, while ISM-2033 is about the lifecycle control of the resulting software security requirements artefacts.

This control partially overlaps ISM-2042.

Annex A 8.27 requires organisations to define and apply secure architecture and engineering principles across system development. ISM-2042 overlaps by requiring Secure by Default practices throughout the software development lifecycle, which is a concrete expression of secure engineering principles. ISM-2042 is more SDLC- and product-configuration oriented, while Annex A 8.27 also encompasses system-level architecture principles beyond software defaults.

This control partially overlaps ISM-2084.

ISM-2084 requires AI-specific documentation (e.g. model/system cards) to record model characteristics, architectures, use cases and security risks. Annex A 8.27 requires secure system architecture and engineering principles to be established and documented, then applied during system development. They overlap where AI system cards capture architecture decisions and security considerations that support secure engineering, but ISM-2084 is specifically about AI model artefacts and risk documentation rather than general engineering principles.

This control depends on ISM-0246.

ISM-0246 requires organisations to engage ASD early in the system life cycle when an emanation security risk assessment is required, to address risks of unintended information leakage from facilities/systems. Annex A 8.27 requires secure system architecture and engineering principles to be defined and applied throughout system development. Early ASD emanation assessment (ISM-0246) strengthens and informs architectural/security engineering decisions (e.g., zoning, shielding, equipment placement) that Annex A 8.27 expects to be made during design. However, Annex A 8.27 is broader across all secure engineering practices, while ISM-0246 is narrowly focused on specialist emanation risk assessment engagement.

This control depends on ISM-1522.

ISM-1522 requires a CDS architecture where upward and downward data paths have independent security-enforcing functions. ISO/IEC 27001:2022 Annex A 8.27 supports this by mandating secure system architecture and engineering principles, which would include principles such as separation of duties, defence-in-depth, and segregation of data flows that justify and guide independent path enforcement in a CDS. Annex A 8.27 is a high-level engineering requirement, whereas ISM-1522 is a specific cross-domain design constraint focused on directional isolation.

This control depends on ISM-1826.

ISM-1826 requires the organisation to select server vendors that demonstrate Secure by Design/Secure by Default and strong secure programming practices. Annex A 8.27 requires establishing and applying secure system architecture and engineering principles across information system development activities. ISM-1826 supports Annex A 8.27 by ensuring third-party server applications are more likely to align with secure engineering principles, but Annex A 8.27 is broader and includes the organisation's own architecture decisions and engineering practices beyond vendor choice.

This control depends on ISM-2060.

ISM-2060 requires code reviews to check that implementations reflect Secure by Design and secure programming practices. ISO/IEC 27001:2022 Annex A 8.27 requires secure architecture and engineering principles to be established and applied, and code reviews under ISM-2060 help verify that those principles are actually realised in code (e.g. correct use of security patterns and controls). Annex A 8.27 is design/engineering-principle focused, while ISM-2060 is an implementation verification mechanism.

This control depends on ISM-2082.

ISM-2082 requires checking imported third-party components via a CBOM to confirm they support standardised ASD‑Approved Cryptographic Algorithms. ISO/IEC 27001:2022 Annex A 8.27 requires secure system architecture and engineering principles to be established and applied during development, which typically include approved cryptographic primitives and patterns. ISM-2082 supports Annex A 8.27 by providing concrete evidence-based validation of cryptographic implementation choices in dependencies, though Annex A 8.27 extends well beyond cryptography to broader architectural principles.

This control is broader than IT.PRO-01.1.

IT.PRO-01.1 requires systems to be designed securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality. These are specific secure engineering outcomes of the kind ISO/IEC 27001 Annex A 8.27 requires to be established as principles and applied to all information system development. Annex A 8.27 is broader because it also requires the principles themselves to be documented and maintained, while IT.PRO-01.1 names particular design objectives.