Just to clarify, my company is a software outsourcing provider (commonly referred to as "outsourcer") and we - not our customer - are planning to get certified to ISO 27001.
Given that we only take care of the the development for customers projects, and don't have access to their production environment or any production data, are the following controls applicable to these projects, or are they only applicable to our internal projects?
A.6.1 Internal organization
A.14.2 Security in development and support processes
-
Those control numbers reference ISO27002 (FYI).– HashHazardOct 17, 2016 at 3:56
-
Thanks, actually I was referring the controls from Annex A of the ISO 27001 standard, but the numbering are the same on ISO 27002.– kamovOct 17, 2016 at 6:16
-
Getting ISO 27001 for your own organization doesn't preclude you from developing software for non-compliant organization. The scope of ISO 27001 is your own organization's internal policies and processes, not your client's.– Lie RyanAug 14, 2017 at 12:35
1 Answer
There are sections of ISO (270002) that refer directly to outsourced development and vendor agreements. The rest pertains to your organization.
Controls that Reference Outsourcing:
- 13.1.2
- 14.2.1
- 14.2.5
- 14.2.7
- 14.2.8
- 15.1.3