[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-27":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-27","Annex A 8.27","Secure system architecture and engineering principles",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Establish, document, maintain and apply principles for engineering secure systems in all development activities.\n\n**In practice.** The organisation defines principles such as defence in depth, least privilege, secure defaults, fail secure, zero trust thinking and separation of duties, and applies them to new systems and significant changes. Architecture reviews check designs against these principles, and outsourced development is held to the same standards through contracts. Principles are reviewed periodically to reflect new threats and technologies. Evidence includes the documented principles, architecture review records and examples of designs that changed as a result.\n\n**Common gaps.** Principles exist as a document that architects and developers have never read. Reviews are skipped for fast-moving projects or cloud services built outside central IT, so the principles only apply on paper.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]