1

Just to clarify, my company is a software outsourcing provider (commonly referred to as "outsourcer") and we - not our customer - are planning to get certified to ISO 27001.
Given that we only take care of the the development for customers projects, and don't have access to their production environment or any production data, are the following controls applicable to these projects, or are they only applicable to our internal projects?
A.6.1 Internal organization
A.14.2 Security in development and support processes

Improve this question
3
  • Those control numbers reference ISO27002 (FYI).
    – HashHazard
    Oct 17, 2016 at 3:56
  • Thanks, actually I was referring the controls from Annex A of the ISO 27001 standard, but the numbering are the same on ISO 27002.
    – kamov
    Oct 17, 2016 at 6:16
  • Getting ISO 27001 for your own organization doesn't preclude you from developing software for non-compliant organization. The scope of ISO 27001 is your own organization's internal policies and processes, not your client's.
    – Lie Ryan
    Aug 14, 2017 at 12:35

1 Answer 1

Reset to default
1

There are sections of ISO (270002) that refer directly to outsourced development and vendor agreements. The rest pertains to your organization.

Controls that Reference Outsourcing:

  • 13.1.2
  • 14.2.1
  • 14.2.5
  • 14.2.7
  • 14.2.8
  • 15.1.3
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .