Ensuring ISO 27001 Compliance in Mobile Applications
ISO 27001 is an international information security management standard. Unlike GDPR or HIPAA, it's not tied to specific data types or jurisdiction. It's a management system (ISMS) you build, document, and audit via accredited certification body.
For mobile app ISO 27001 means: all development, deployment, and operations processes embedded in organization's ISMS. Technical controls — only part of requirements.
What Annex A Means for Development
ISO 27001:2022 contains 93 controls in Annex A, grouped in 4 themes. For mobile development most significant:
A.8 Technological controls — most technical measures:
- A.8.2 Privileged access rights — who accesses signing keys, production API keys, certs
- A.8.7 Protection against malware — third-party SDK vetting before inclusion
- A.8.9 Configuration management — all configs under version control, no hardcoded secrets
- A.8.20 Networks security — TLS everywhere, network security config, certificate pinning
- A.8.24 Use of cryptography — AES-256 at rest, TLS 1.3 in transit, key management
A.5 Organizational controls — processes:
- A.5.8 Information security in project management — security by design in SDLC
- A.5.23 Information security for use of cloud services — vendor assessment for each cloud provider
- A.5.30 ICT readiness for business continuity — backup, DR plan
Technical Controls in Mobile App
Secret Management
Hardcoded API keys in code — violates A.8.9 and common audit finding. In mobile app secrets never reach repository:
// Wrong — violates A.8.9
val apiKey = "sk-prod-abc123xyz"
// Right — from BuildConfig via CI/CD secrets
val apiKey = BuildConfig.API_KEY
// Even better — key obtained from server on auth
val apiKey = tokenManager.getApiKey()
For iOS — via xcconfig files not committed to repo, and via Info.plist from CI/CD environment.
GitLeaks in pre-commit hook and CI pipeline catches accidental secret commits.
Cryptographic Key Management (A.8.24)
ISO 27001 requires documented key management policy: rotation period, rotation procedure, storage. For mobile app:
- TLS certificates: rotation 30+ days before expiry, certificate pinning updated via OTA config (not hardcoded)
- App signing keys: storage in HSM or cloud KMS (AWS KMS, Google Cloud KMS), not developer's local disk
- Encryption keys for local data: in Android Keystore / iOS Secure Enclave, no export
Vulnerability Management (A.8.7, A.8.8)
Documented process:
- SAST — static analysis on each PR (MobSF in CI, Semgrep custom rules)
- Dependency scanning — Dependabot or OWASP Dependency-Check for vulnerable libraries
- Pentest — annually or after major changes. Report retained as audit evidence
- Remediation SLA — critical: 24 hours; high: 7 days; medium: 30 days
For ISO 27001 auditor need not just tools but documented process with proof of execution.
Secure SDLC (A.5.8)
ISO 27001 requires security built into development process:
- Threat modeling on feature design — STRIDE or PASTA, documented result
- Security requirements in acceptance criteria of each epic
- Security-focused code review for auth, encryption, data storage changes
- Security testing before each major release
Documentation Needed for Certification
Auditor examines documents. For mobile app mandatory:
- Asset inventory — info assets: source code, signing keys, production data, docs
- Risk register — risk assessment per asset: threats, probability, impact, treatment
- Statement of Applicability (SoA) — which controls apply, which excluded and why
- Incident response plan — procedure on security incident (breach, signing key compromise)
- Supplier security policy — security requirements for third-party SDKs and cloud services
Certification Scope
ISO 27001 certifies organization, not app. ISMS scope defined in document: "development and support of mobile app X including supporting infrastructure". Auditor checks everything in scope.
Without full certification resources — voluntary compliance assessment (ISO 27001 self-assessment) and gap analysis report acceptable. Many clients accept this as intermediate step.
Timeline
Gap analysis + roadmap: 1–2 weeks. Technical controls implementation: 4–8 weeks. ISMS documentation + audit prep: 2–4 months. Full certification cycle: 4–9 months.