Back ups – are you ready for disaster?
Categories:
data security
Categories: data security
 While we all hope that nothing bad will happen to our project data, it is really important to have backups in place. Backups protect against data loss. I know that seems really obvious to say, but regular backup safeguard you and your project data against system failures, human errors, and accidents. Because who hasn't ever worried about reverting to a previous version of a spreadsheet or overwriting a change that you shouldn't? Well, those are small examples of the impact if data is lost. In a more substantive way, having a recent backup means the project can carry on with minimal disruption. It's often not the project manager's responsibility to set backups in place, because these will be managed by your IT team. But it is worth asking what data is backed up and how you would access it if you ever needed to because a long term project that loses all of its schedules and financial spreadsheets... That situation could be very difficult to recover. Another thing to consider is corruption. That is, data corruption or errors, because if there are problems with the data, a recent backup can restore the latest saved version and that will give you a fighting chance at recovering what you need to and keeping your records consistent and accurate. As I said, you probably don't get the opportunity to set the backup frequency, or even to identify whether or not a backup will happen for the particular system that you're using. But some cloud based project management software will give you the choice in the settings. If you have the choice, pick a regular interval that works for you. If it's a tool that you're using all day every day, you'll want a more frequent backup because then you can minimise the risk of data loss between the backup windows. If it's something that you only go into infrequently, you might be able to get away with having a backup once a week or once a month. Putting aside the issue of backing up an entire project management software system for a moment, let's think about the different versions of project documents and artefacts that you use on a regular basis. When you've got version controlled backups, for example in your online document storage, that can give you the chance to roll back to the previous version if you end up with discrepancies. For example, somebody accidentally going in and deleting slides from your steering deck, or wiping all the data from a tab in a spreadsheet. Your IT team may share that there are a few different types of backups that you can do, so let's just look at those for a second. Full backups give you complete copies of all project data, which gives you the confidence that everything is recoverable. These are quite expensive though. Incremental backups only back up the changes made since the last backup. That's faster, and means your storage utilisation is less. But it can be harder to recover if you have to recover everything. I think these days most of us rely on cloud storage, which is storing backups in the cloud linked to the software system or app that we're using. That gives you remote access which is a reassurance against hardware failure, because if you've ever had a laptop die after you spilled coffee on it, then you know that it's important to have off-site backups and remote backups and cloud backups because storing things on your hard drive can cause problems later (Don't ask me how I know). Take this article as a reminder that it is important to manage your project management tools and documents using automated backup solutions that reduce the risk of human error and takeaway the fact that you have to think about doing the backups at all. Mostly your tools will have this built in because it's not an unusual requirement, but if you can't see how a product is backing itself up then it's worth asking the vendor or your IT team. Just to be doubly sure that you have that confidence and security that all of your project-related data is safe. |
Why is my data wrong?
| I know we’d all like to rely on our PowerBI or Tableau reports, or whatever data source you use for tracking business metrics, but those reports are only as good as the data that goes into them. That goes for our project management tools as well. If you’re looking at a resource chart trying to work out how to manage capacity over the coming weeks, you’d better be looking at the right inputs. When the underlying data is wrong, it can throw off your scheduling. But why is data wrong in the first place? No one goes into work and knowingly types in incorrect figures just to make your day difficult. If you’re worried about the integrity of the data, or you want to do an audit check, or even just highlight the importance of getting it right to your team, here are some places you can look.
Human errorLet’s start with the most obvious: Incorrect data input by project team members can lead to inaccuracies in schedules, budgets, and resource allocation. Manual errors in data processing causes more headaches, in my opinion, than anything else. While we’re on the topic of how humans type things in, let’s talk about inconsistent data formatting. Without standardised data entry methods, inconsistencies such as different date formats or unit measurements can impact data integrity. Software ErrorsHow much downtime does your project management tool, or any other data repository that you use, have? How often do you have to raise tickets? I heard about one team who had been successfully navigating around a bug in the system they used, and talked about how they were managing as if it was a badge of honour – don’t do that! Raise a ticket with the right support team and get it fixed. You never know what kind of impact a bug is having behind the scenes. Even the best project management software may experience a glitch from time to time that could mean you lose data or it gets corrupted. This can happen when you are syncing data or updating project information, for example importing a spreadsheet from one system to another. Sometimes we also see issues where multiple users are trying to access or modify the same document or data set where version control hasn't been used. That gives you multiple versions of the same information and no one knows which is the correct one. External factorsSometimes it's factors beyond your control that cause problems with data. If you have a network failure, for example, and you're in the middle of doing a data sync, that might affect the inputs. Even hardware failures, the blue screen of death, or losing a USB stick can cause problems (not that you store anything on external drives, right?). Data integrationIn my experience, one of the biggest issues with making sure your data is correct across all systems is how the interfaces work. If you are building interfaces between various systems you have to make sure that the testing is adequate. Whether you are integrating your project management software with financial planning software or a resource management tool or whether you are taking project data out of a scheduling system and putting it somewhere else, it has to be accurate. Another issue is where the data is being exported from one system in one format and needs to be in a different format for another system —this is particularly relevant with dates. Identify which system is the single source of the truth and make sure the integrity of that is maintained. What other issues do you have with data integrity and how do you get round them? |
What to look for in project management software: Data privacy edition
| Over the past few articles I’ve talked about different aspects of data privacy and how that links to project management deliverables and the ways of working for the team. One of the big things that we use as project managers is our software, and often we’re involved with selecting new tools or upgrading existing tools. In this article, I wanted to point out a few things you should be looking for in your PM tools to make sure that you’re having the right conversations about whether they are secure enough for your data. I’m sure your info sec teams will also have a lot to say, so use the content below as a starting point for a discussion, not a replacement for guidance from your internal teams!
Access control and permissionsEnsure that the tool allows for granular control over who can access sensitive data. Role-based access control (RBAC) is essential for minimising the risk of unauthorised access. What this looks like in practice is that you might have one person on the team with admin or ‘override’ permissions, and everyone else just enters the data. In one company I know, the workflow pushes a project between stages. While it’s going through the approval process, no one can edit the data. That’s good because it means all approvers are seeing the same thing, but also a bit annoying if you’ve accidentally left something out or there is another very valid reason for needing to add another attachment, for example. Admin users could have the power to make changes while a record is blocked for editing by ‘normal’ users, but it’s a power to use very carefully! Data encryptionVerify whether the tool provides end-to-end encryption for both data at rest and data in transit. This ensures that data remains secure even if intercepted, which is important for software that is hosted in the cloud, or for financial information. I don’t know why you’d need information like bank card records in a project management tool, but even your business case information should be company-confidential and you wouldn’t want it accessible in case of a data breach. Data storage and backupAssess where the data is stored and whether that meets your requirements. For example, in the UK there are rules around where patient data is stored in the healthcare industry – we couldn’t have certain data stored in off-shore data centres, for example. Check out your regional data privacy laws. Again, project management software isn’t going to have the kind of sensitive, personal information that’s on the same scale as medical records, but you still want to be sure it meets your company’s policies for storage. The same goes for backup. However good your internal systems and however reliable your supplier, can you get the data back when there’s a problem? Audit logsThis feature is so helpful in the project management software that I use. It’s great to easily be able to see what changed, when and who changed it. Check if the tool has built-in auditing and tracking features that allow for monitoring access to data and changes to project information. And if it does, who has access to see the audit logs (I’m a believer in transparency here – why not make them available to everyone?). CertificationsIf you’re using software that you’ve bought in, check to see if it (or the company that makes it) has any data or compliance-related credentials like ISO 27001, SOC 2, or EU-U.S. Privacy Shield, which indicate that the tool has passed rigorous security and privacy assessments. That’s not an exclusive list, but you can use the ideas above as a starting point for thinking about the requirements for data security and privacy for your project management software. What did I leave out? Let me know in the comments! |
Training teams on data privacy best practices
| One of the major risks facing our projects today is data – and all the problems that can arise when the wrong data falls into the wrong hands. Even if nothing malicious happens with the data, the fact there was a breach can lead to reputational damage and fines. And no project manager wants their project to be the one where data leaked out. So we work on making sure data privacy best practices are built into the way projects are delivered. Mostly, data privacy regulations are baked into internal processes and policies, but it never hurts to have a reminder. Here are some things you can do to foster a culture of data privacy awareness in the team, so they automatically (hopefully) consider data privacy when they are working out work packages and activities.
Start with cultureBuild a culture of data privacy. Lead from the top and make it expected that privacy is just ‘how things work around here.’ Make data privacy a part of the team’s daily routine by integrating best practices into everyday project management tasks, such as reviewing documents, storing information, and sharing data. For example, think through who has access to what data, and who gets permission to delete it. I had an interesting discussion with some German colleagues recently who shared that the data privacy laws there are so strict that you can’t ask employees for some information, which must make some aspects of performance reviews, feedback, celebrating birthdays and employee satisfaction surveys really difficult! (If you’re based in Germany, let us know your thoughts in the comments below, or if your country has similar restrictions, tell us about them!) Offer formal trainingIf your company offers mandatory data privacy and security training programs for all team members (and they probably do) make sure everyone does the modules. It’s usually e-learning and not onerous, but that also means that people have a tendency to skip to the test or assessment part without actually paying that much attention to the training. However, it’s the minimum people need to do. This training will most likely cover topics like identifying sensitive data, safe data handling practices, and understanding legal requirements – all things you need to have top of mind for projects. Work through examplesUse your team meetings to work through practical scenarios. Use real-world examples or case studies, for example, internal projects or projects in the media in your industry, to illustrate the importance of data privacy and the consequences of non-compliance. Ask the risk management team if they could write some scenarios for you to discuss and add them to your team meetings a way of upskilling. Set clear data handling guidelinesYour company might already have overarching data handling guidelines, so you can lean into those, or set specific ones for your project if it’s data heavy. Guidelines should cover data collection, storage, sharing, and disposal. When you kick off a new project, ensure that every team member understands the policies and any other applicable laws. Stay on top of changesOne thing I’ve noticed in the 20+ years I’ve been managing projects is how often things change. Privacy law and data laws are changing all the time as technical advancements introduce different types of data and ways that it needs to be managed (AI and deep fakes being cases in point at the moment). Don’t assume nothing has changed since you last did a project with a big data element. Talk to your legal team and get the latest. Talk about the implications of non-complianceMake sure people are aware that it’s not a small problem if there is a data breach or non-compliant situation. Your company could risk:
And sometimes the individual might be liable as well as the organisation… so know what you are getting yourself into! |
Data considerations for your project
Last month I looked at some of the basics for data privacy on projects. Let’s go into that in a bit more depth this month, by looking at some of the project tasks you can schedule to help manage data on your project within the regulations of your country, whatever they are. 
The data mapping exercise should help you understand where, how, and why data is being collected throughout the project lifecycle and beyond.
A DPA is a document that outlines how data will be handled, stored, and protected. There is probably a template within your organisation already. Alternatively, the task is to check that DPAs are already in place, if the vendor is one that you use regularly. I like the kind of tasks that can easily be checked off! They help the team feel they are making progress and ensure that you are putting compliance at the forefront of your processes.
Again, if your company already has a relationship with the third-party, the task here is to check that it was done at some point and does not need to be done again.
Generally, the IT team would have to take responsibility for doing these things or checking that they are already in place from a third party. Talk to them about the kinds of tasks that need to go on the schedule so they have enough time to put security measures live before the project launches.
Again, talk to your technical teams about what this might look like for your projects and put the time in for this work so it doesn’t get squeezed in at the last minute or forgotten about. All of these scheduleable (is that a word?) tasks will help you address any risks or issues relating to non-compliance and show that you are actively prioritising data privacy. Next time I’m going to look at training teams on data privacy best practices. Meanwhile, why not share your experiences of data on your projects in the comments below? Thanks! |
