ISO 27001 A.8.27 - Secure System Architecture and Engineering Principles

Requirement

“Principles for engineering secure systems shall be established, documented, maintained and applied to any information system development activities.”

Plain-language meaning

The organization should define architectural and engineering principles that guide how systems are designed securely. These principles should be documented, maintained, and used across system development activities.

This is broader than code quality. It includes architecture decisions, trust boundaries, secure defaults, least privilege, defense in depth, zero trust where appropriate, segregation, resilience, logging, privacy, and secure integration.

Why this matters

Security is cheaper and more effective when designed into architecture from the start. Retrofitted security is often incomplete, expensive, and operationally fragile.

Secure engineering principles give teams a common baseline for building systems that are secure by design instead of relying on late testing to catch architectural flaws.

Implementation guidance

1. Define engineering principles

Examples include least privilege, secure by default, defense in depth, fail securely, minimize attack surface, segregate duties and environments, protect secrets, log security events, validate inputs, encrypt where required, and design for resilience.

2. Tailor principles to the environment

Principles should fit the organization’s technology, risk profile, regulatory environment, development model, cloud/on-prem architecture, supplier model, and culture.

3. Apply principles in design work

Use the principles in architecture reviews, design approvals, threat modelling, project security requirements, procurement, cloud design, and implementation decisions.

4. Maintain and communicate principles

Principles should be kept current as threats, architecture patterns, cloud services, development frameworks, and organizational practices change.

5. Cover contractors and external parties

Contractors and suppliers involved in system development should know and apply the same engineering principles where relevant.

Audit guidance

Auditors should verify:

• secure system architecture and engineering principles are documented;
• the source or basis of the principles is understood;
• principles are suitable for the organization;
• principles are maintained and reviewed;
• principles are applied in system development activities;
• architecture/security roles are competent;
• contractors and external parties receive and follow the principles;
• architecture reviews or design records show use of principles;
• deviations are risk-assessed and approved.

Evidence examples

Strong evidence

• Principles are specific enough to guide decisions.
• Architecture reviews reference principles.
• Threat models or design reviews identify and treat risks.
• Deviations are approved and risk-assessed.
• Contractors and suppliers are covered.
• Principles are updated after technology or threat changes.

Weak evidence

• Principles are generic slogans.
• Architecture decisions do not reference security principles.
• Security architecture role is unclear.
• Contractors use separate unmanaged design practices.
• Principles are never reviewed.
• Exceptions are handled informally.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.25 Secure Development Life Cycle
• A.8.26 Application Security Requirements
• A.8.20 Networks Security
• A.8.22 Segregation of Networks
• A.8.24 Use of Cryptography
• A.5.8 Information Security in Project Management
• A.5.20 Addressing Information Security Within Supplier Agreements
• Risk Assessment
• Statement of Applicability
• Secure Architecture Principles Standard
• Security Architecture Review Record
• Security Engineering Deviation Record
• A.8.27 Audit Evidence Pack
• A.8.27 Audit Checklist

KB-ready summary

• Define secure architecture principles.
• Tailor principles to the environment.
• Apply them in design and architecture reviews.
• Manage deviations.
• Communicate them to contractors and suppliers.
• Review and update them.

Templates and checklists

• Secure Architecture Principles Standard
• Security Architecture Review Record
• Security Engineering Deviation Record
• A.8.27 Audit Checklist