1

Just to clarify, my company is a software outsourcing provider (commonly referred to as "outsourcer") and we - not our customer - are planning to get certified to ISO 27001.
Given that we only take care of the the development for customers projects, and don't have access to their production environment or any production data, are the following controls applicable to these projects, or are they only applicable to our internal projects?
A.6.1 Internal organization
A.14.2 Security in development and support processes

  • Those control numbers reference ISO27002 (FYI). – HashHazard Oct 17 '16 at 3:56
  • Thanks, actually I was referring the controls from Annex A of the ISO 27001 standard, but the numbering are the same on ISO 27002. – kamov Oct 17 '16 at 6:16
  • Getting ISO 27001 for your own organization doesn't preclude you from developing software for non-compliant organization. The scope of ISO 27001 is your own organization's internal policies and processes, not your client's. – Lie Ryan Aug 14 '17 at 12:35
1

There are sections of ISO (270002) that refer directly to outsourced development and vendor agreements. The rest pertains to your organization.

Controls that Reference Outsourcing:

  • 13.1.2
  • 14.2.1
  • 14.2.5
  • 14.2.7
  • 14.2.8
  • 15.1.3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.