A.8.27 Secure system architecture and engineering principles
Establish and apply secure engineering principles to system development.
20
artefacts
1
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Vulnerability scan summary · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Risk assessment matrix · Policy repository / GRC workspace
- Penetration test report · Vulnerability scanner / patch tooling
- Change approval meeting minutes · Ticketing / ITSM
- Post-implementation review log · SIEM / log platform
governing documentDocuments that govern the control
- Enterprise architecture diagram · Policy repository / GRC workspace
- Network segmentation diagram · Policy repository / GRC workspace
- Component interaction matrix · Policy repository / GRC workspace
- Data flow diagram · Policy repository / GRC workspace
- Secure coding standards document · Policy repository / GRC workspace
- Design pattern checklist · Document repository
- Reference architecture guide · Policy repository / GRC workspace
- Security requirements specification · Document repository
- Threat model report for critical application · Document repository
- Attack tree diagrams · Document repository
- Mitigation plan · Policy repository / GRC workspace
- Static code analysis results · Document repository
- Dynamic application security testing report · Document repository
- Change request forms · Policy repository / GRC workspace
- Implementation rollback procedures · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Vulnerability scanner / patch tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Design reviews not documented
- Threat modeling performed sporadically
- Secure coding standards not enforced
- Testing results not linked to remediation
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.8.26 Application security requirements · A.8.28 Secure coding