#iso27002/2022/EN
## 5.8 Information security in project management

#### Control
Information security should be integrated into project management.

#### Purpose
To ensure information security risks related to projects and deliverables are effectively addressed in project management throughout the project life cycle.

#### Guidance
Information security should be integrated into project management to ensure information security risks are addressed as part of the project management. This can be applied to any type of project regardless of its complexity, size, duration, discipline or application area (e.g. a project for a core business process, ICT, facility management or other supporting processes).

The project management in use should require that:

a)   information security risks are assessed and treated at an early stage and periodically as part of project risks throughout the project life cycle;

b)   information security requirements \[e.g. application security requirements ([8.26](a-8.26-Application-security-requirements.md)), requirements for complying with intellectual property rights ([5.32](a-5.32-Intellectual-property-rights.md)), etc.] are addressed in the early stages of projects;

c)   information security risks associated with the execution of projects, such as security of internal and external communication aspects are considered and treated throughout the project life cycle;

d)   progress on information security risk treatment is reviewed and effectiveness of the treatment is evaluated and tested.

The appropriateness of the information security considerations and activities should be followed up at predefined stages by suitable persons or governance bodies, such as the project steering committee.

Responsibilities and authorities for information security relevant to the project should be defined and allocated to specified roles.

Information security requirements for products or services to be delivered by the project should be determined using various methods, including deriving compliance requirements from information security policy, topic-specific policies and regulations. Further information security requirements can be derived from activities such as threat modelling, incident reviews, use of vulnerability thresholds or contingency planning, thus ensuring that the architecture and design of information systems are protected against known threats based on the operational environment.

Information security requirements should be determined for all types of projects, not only ICT development projects. The following should also be considered when determining these requirements:

a)   what information is involved (information determination), what are the corresponding information security needs (classification; see [5.12](a-5.12-Classification-of-information.md)) and the potential negative business impact which can result from lack of adequate security;

b)   the required protection needs of information and other associated assets involved, particularly in terms of confidentiality, integrity and availability;

c)   the level of confidence or assurance required towards the claimed identity of entities in order to derive the authentication requirements;

d)   access provisioning and authorization processes, for customers and other potential business users as well as for privileged or technical users such as relevant project members, potential operation staff or external suppliers;

e)   informing users of their duties and responsibilities;

f)   requirements derived from business processes, such as transaction logging and monitoring, non-repudiation requirements;

g)   requirements mandated by other information security controls (e.g. interfaces to logging and monitoring or data leakage detection systems);

h)   compliance with the legal, statutory, regulatory and contractual environment in which the organization operates;

i) level of confidence or assurance required for third parties to meet the organization’s information security policy and topic-specific policies including relevant security clauses in any agreements or contracts.

#### Other information
The project development approach, such as waterfall life cycle or agile life cycle, should support information security in a structured way that can be adapted to suit the assessed severity of the information security risks, based on the character of the project. Early consideration of information security requirements for the product or service (e.g. at the planning and design stages), can lead to more effective and cost-efficient solutions for quality and information security. ISO 21500 and ISO 21502 provide guidance on concepts and processes of project management that are important for the performance of projects.

ISO/IEC 27005 provides guidance on the use of risk management processes to identify controls to meet information security requirements.