PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

Annex A control A.8.26 Application security requirements mandates that security requirements must be identified, specified, and approved during the development or acquisition of applications.

“Information security requirements shall be identified, specified and approved when developing or acquiring applications.”

— ISO/IEC 27001:2022, Annex A, Control 8.26 Application security requirementsQuestion No. 22/80

What iS the purpose of ISO,'IEC 27002 clause 8ü8?

TO ensure all security requitements are addressed during application development

To ensure software is written securely to reduce information security vulnerabilities

To ensure secure system design principles are followed

ISO/IEC 27002:2022 Clause 5.17 – Information Security in Project Management, and Clause 5.2 – Roles and Responsibilities, support role flexibility provided responsibilities are clear and documented.

The same group can assume multiple roles, provided:

The roles are defined

Competency is proven

There is no conflict of interest

It’s acceptable and sometimes encouraged for an established, competent committee like the ISC to assume emergency roles during incidents, enhancing response efficiency.

ISO/IEC 27001:2022 Clause 5.3 – Organizational roles, responsibilities, and authorities clearly states:

"Top management shall assign the responsibility and authority for:

a) ensuring that the ISMS conforms to the requirements of this document;

b) reporting on the performance of the ISMS to top management."

This means top management is not solely responsible for directly reporting on performance—it can assign this responsibility to a qualified individual (such as an ISMS manager, CISO, or another responsible party). Therefore, Option A is incorrect and violates the intent of Clause 5.3.