ISO 27001 A.5.8: Information security in project management

Update your project management methodology to include mandatory security checkpoints at each phase. At a minimum: security requirements gathering during initiation, risk assessment during planning, design review during development, security testing before deployment, and formal sign-off before go-live. Create a security requirements checklist that project managers must complete at the start of every project. Cover data classification, access requirements, regulatory obligations, integration with existing controls, and any new risks the project introduces. Use the results to determine how much security involvement the project needs. Define security gate criteria for milestones. A project should not move from design to development without a security architecture review, and should not go live without security testing and a vulnerability assessment. Enforce these through your project governance process. Make sure your security team is resourced to support projects. Assign security champions to high-risk projects, offer consultation for lower-risk ones, and maintain a library of security requirements and design patterns that project teams can reference. Train your project managers on security basics and what the methodology requires of them. They need to know when to involve the security team, how to engage them, and what deliverables are expected at each stage. Include security criteria in project success metrics and post-implementation reviews.