Key takeaways
- Identify and approve security requirements when building or buying applications.
- Clear security requirements make sure applications are built to protect data.
- Start here: identify security requirements when defining applications.
Purpose
Identify and approve security requirements when building or buying applications.
Requirement
Requirement summaryInformation security requirements shall be identified, specified and approved when developing or acquiring applications.
Why it matters
Clear security requirements make sure applications are built to protect data.
How to implement
- Identify security requirements when defining applications.
- Cover authentication, authorisation, logging and data protection.
- Include requirements for purchased software too.
- Verify requirements during testing.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.26. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for defining security requirements for new or changed applications.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.26 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Security requirements written into feature or project specifications.
- Test results showing those requirements were checked.
- Sign-off before release.
Things you should be able to show or explain
- Product owners should be able to explain how requirements are decided.
How much to show: Two or three features or applications.
Common mistakes
- No security requirements captured.
- Requirements never tested.
- Requirements limited to functionality only.
- Buying software without checking its security.
- Tip: Include security criteria in vendor selection.
Policies & documents to have
- Secure Development Policy
- Third-Party Management Policy
FAQ
Is A.8.26 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.26?
Be ready to explain how the control works in your organisation and to provide things like: Your process for defining security requirements for new or changed applications…