Implementing information security best practices on software lifecycle processes: The ISO/IEC 15504 Security Extension
ISO/IEC 15504-5 processes can be adapted to deploy ISO/IEC 27002 controls on them. Relations between ISO/IEC 15504-5 and ISO/IEC 27002 security controls are analysed. From these relations, the ISO/IEC 15504 Security Extension has been developed. The Design Science Research paradigm has been followed during its development. The ISO/IEC 15504 Security Extension has been validated in industry.
security extension iso/iec 27002 information security management systems iso/iec 15504 (spice) software process improvement (spi)