Objective 3: Set the direction of acquisition
Security risk should be assessed before new activities, investments, purchases, mergers, technology adoption, outsourcing and supplier contracts, not after them.
What clause 7.2.3 asks
New ventures are the test. Before an organization invests, buys, merges, adopts a technology, outsources a service or signs with a supplier, it should assess how the change affects security risk. The clause asks for security to be built into the processes the entity already uses: project management, purchasing, spending, legal duties, regulatory duties and strategic risk. Each management system's leadership should then set a security strategy from the organization's aims, reconciling what the entity needs with what the organization needs and answering the current and future expectations of interested parties. A policy alone is not a strategy, and a strategy that never reaches the investment decision is a document rather than a direction.
Why it matters
Acquisition is where governance is most often overtaken by the deal. A purchase is approved on a business case, the security review arrives a month later, and the only remaining decision is how to live with the result. The clause asks for the security impact to be part of the decision, through the gates that already exist. It also asks each management system to have a strategy, not just a policy. A policy says what must be done. A strategy says what the organization is trying to achieve with security over the next period, and how the entity requirements and the organization requirements are reconciled. The two levels can pull apart in a group, which is why the harmonising duty is explicit.
What good looks like
Take the five acquisition routes named in the clause and mark where the security assessment enters each one. If the assessment enters after approval, move the gate. Write the security strategy for each management system with a horizon, the entity objectives it serves and the interested party needs it answers. Reconcile the strategy with the entity strategy at the same meeting where investment is approved. Keep the security assessment attached to the business case, not in a separate file.
Evidence a board or an auditor asks for
The acquisition gate map for investment, procurement, merger, technology and outsourcing; a security assessment attached to a live business case; the security strategy with a horizon and the entity objectives it serves; the reconciliation minute.
- Record The acquisition gate map for investment, procurement, merger, technology and outsourcing
- Record a security assessment attached to a live business case
- Record the security strategy with a horizon and the entity objectives it serves
- Record the reconciliation minute
Where it commonly fails
- Acquisitions and outsourcing decided before security is assessed
- A security policy with no strategy behind it
- A group strategy and a business unit strategy that contradict each other
What to do before publication
Before the edition 3 text is published, put clause 7.2.3 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 7.2.2 Objective 2: Make decisions using a risk-based approach
- 7.3.2 Evaluate
- 7.3.3 Direct
- 8.1 Organization and ISMS
← 7.2.2 Objective 2: Make decisions using a risk-based approach7.2.4 Objective 4: Ensure conformance with internal and external requirements →