Changes on project-managed applications or database should undergo the change control process as documented.

The statement is true. The ISO/IEC 27001 standard mandates the implementation of a formal change management or change control process. This process is essential for ensuring that all modifications to information processing facilities, systems, applications, and databases are properly reviewed, tested, and approved before implementation. Applying this documented process to project-managed changes is critical for maintaining the security posture of the organization, preventing the introduction of new vulnerabilities, and ensuring the continued integrity, availability, and confidentiality of information. This control applies regardless of whether the change is part of a large project or a minor operational update.

B. False: This is incorrect. Neglecting to apply a documented change control process to project-managed systems would directly contravene the requirements of ISO 27001 and introduce significant, unmanaged information security risks.

---

1. ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements.

Reference: Annex A, Control A.12.1.2 "Change Management". This control explicitly states that "Changes to the organization, business processes, information processing facilities and systems that affect information security shall be controlled." This includes applications and databases managed within projects.

2. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Control 8.32 "Change management". The implementation guidance for this control requires that "rules for the change of information processing facilities and systems should be established and documented," reinforcing the need for a formal process for all changes, including those in projects.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Reference: Chapter 15, "Annex A controls," Section on A.12.1.2 Change management. The text explains that a formal change control procedure is necessary to ensure that changes do not compromise security. It emphasizes that this applies to all stages of a system's lifecycle, including development and project phases.

4. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 11, "Operations Security," Section on Change Management (A.12.1.2). The author details the necessity of formal change management procedures, stating, "The objective here is to ensure that changes to information processing facilities and systems are controlled... This applies to hardware, software, and procedures." This inherently covers project-managed applications and databases.