Implementing ISO 27001 A12.1.1 Security Requirements Analysis and Specification

[lufaso]

Hi
about ISO 27001, control A12.1.1 Security requirements analysis and specification...

How do you implement this control? How can I show conformity?

Any help will be appreciated...

 

[Stijloor]

A Quick Bump!

Can someone help?

Thank you very much!!

 

[Richard Regalado]

Sorry for the late reply.

This control is pretty straightforward. As this is information security, the standard is saying that when you design systems, security should be part of the design and analysis stage. Not after. During the design stage the following should be considered:

1. who can access?
2. how to validate access?
3. if passwords, how long? complexity rules? expiration?

ISO/IEC 27002 provides a long-list of guides for ISMS controls.