Integrating Information Security Management System from ISO/IEC 27001 with Software Project Management Utilizing Scrum Framework

The integration of an Information Security Management System (ISMS) into software project management is essential due to the presence of sensitive data such as financial records and personal information. Unauthorized access or misuse of this data can result in severe consequences for both data owners and service providers. Consequently, embedding ISMS throughout the software development lifecycle is imperative. Given the dynamic nature of modern software projects, adopting Scrum practices enables instantaneous adaptation. However, integrating ISMS with Scrum-based project management presents a challenge in balancing rigorous security controls with Scrum’s agile characteristics. This paper proposes Scrum-based Project Management with Information Security Methodology (SPMSEC), which integrates ISO/IEC 27001:2022 standards into a Scrum-driven project. The approach is guided by practices from the Project Management Institute and the Scrum Guide. It is comprised of 5 phases, each with specific activities and roles to reinforce information security in Scrum-based project management. Additionally, a prototype tool for Information Security Management System has been developed to enhance ISMS effectiveness within Scrum-based software projects.