← ISO 27001 Annex A in plain English

A.8.26 A.8

Technological / A.8.26

Security requirements defined for applications

Think of it likeAgreeing the extension needs a fire door before drawing the plans.

In plain English

The family decides what protections something must have before it is built, rather than discovering the requirement at inspection.

Related CSF and CIS controls (unofficial mapping)