How to manage security in project management according to ISO 27001 A.6.1.5
Security in project management is a completely new thing in the 2013 revision of ISO 27001 – many people are wondering how to set it up, and whether their projects should be covered with this control at all. Read this article to find the answers…
It is likely that you’ve heard that “the security of the information not should be seen as a product; it should be seen as a process.” This implies, among other things, that the security of the information is present in any establishment of the organization, being a pillar of the same, and serving as a cross support to the entire organization. Saving Changes...
Sean FullerTechnical Account Manager| ECX Systems, LLCTyler, Tx, United States
I think that's a great idea. When we implemented our current project management tool, we had to enable "Enhanced" permissions so project visibility could be controlled. For the most part, I am a big believer in transparancy in projects so everyone involved can stay informed but there are scenarios where information needs to be controlled and this topic seems to be generally poorly addressed in the project management world. Saving Changes...
Sisca YuliharyaniSr. PM Consultant | Chief Strategy Officer| IndonesiaBandung, West Java, Indonesia
Nice advice George, but i think maybe it was included in Project Risk Management. How do you think? Saving Changes...
Deepa KalangiManager, Program Management, Author, Trainer| CVS HealthCharlotte, NC, United States
Yes, it fully deserves a separate knowledge area for the main reason that many companies are now high on security...and it has to be #1 priority with increasing vulnerabilities, spams and hacks going on...But the only caveat is this area is vast, so carefully need to select the subject matter for a PM. Saving Changes...
I am going to take a different tact on this subject. This is what I do for a living and I think you need to understand the value of the information, who is it valuable too and what you are really protecting. Are you using cutting edge technology? Are you going to file for a patent in the process of the project? Are you using current technology in a different way?
The information should be evaluated on the risk of loss and the type of loss, financial, claims or liability loss or reputational loss. How severe would the loss be and does it warrant protective measures?
There also need to be mechanisms in place to secure the project information and provide some training for the project team members. Can access controls be implemented. Have these measures been included in the project budget?
My feeling is we already include the pieces of what needs to be done in the knowledge areas we just need to more fully use what is already available, for example risk management, team training and education, using a document management system to organize the project documentation manually or with the assistance of a tool, and providing access to the project information based on the person's need to know.
What really needs to be done is raise the awareness of the need for security. Most of the breaches are actually caused by uneducated behavior. If you are trying to prevent leakage,education and training should be a priority, however if someone is really going to take the information for nefarious purposes it is very hard to stop them. Saving Changes...
Renee RobinsonPMO Director| C2GOrlando, FL, United States
I think it is a great suggestion and something we should all be well versed on, and continue to evolve in at this time. Intellectual property, corporate knowledge, and even PII do influence many aspects of modern projects and have had significant influence on certain projects I have worked on. Saving Changes...
John TiesoAuthor, Lecturer in Business Management| The Catholic University of America, Busch School of Business & EconomicsArlington, Va, United States
George: You are a man after my own heart. I have argued for security as an area for years. Now, this particularly due to my concentration on government or public projects, versus commercial or private projects, but, nonetheless, security is becoming a more critical issue all the time.
I appreciate Susan's comments above, and agree that security is at least part of risk, but I would go further and argue that it has had an increased urgency, and should be involved in all phases of a project, including, by the way, team selection ,training, and responsibility.
Having the ISO standards is a good place to start Saving Changes...
Community Champion
