Development and Inclusion of Information Security specific process(es) in PMBOK to equip PM and PM team to better manage and handle security of all sensitive Project Information/data during project d

Kiron,

Thanks for your valued feedback.Your point is well taken but it is helpful only in those organisations which have a mature and robust Information Security and BCP/DR culture and setup in place.

For other organisations that have a weak or no securtiy culture and setup in place, I believe PM and PM team still have the ownership and accountability for ensuring that all sensitive project information/data of their project is adequately secured to ensure its confidentiality, integrity and availability is maintained throughout the project life cycle. It is critical to ensure that customer confidence is not lost and any contractual obligations are not adversely impacted which also one of the primary responsibility of PM and the team. In such organisations with no Security culture and maturity, PM and PM team with some knowledge of security related issues, threats, processes, tools and techniques can easily ensure security is better managed and maintained. Though PM and PM team may also take opinion and support of some SME but having basic security awareness and access to Security relevant processes, tools and techniques will be of immense value especially in today’s Security scenario and ever changing threat landscape.

Interesting point Sergio. However, would like to clarify here that Information Security is not only about the security of digital information stored and processed on computers or some other similar computing devices such as servers, mobiles, tablets and laptops. Information Security is very comprehensive in its scope and deals with the security of all forms of Information such as digital, paper, audio, video, spoken etc. and all types of physical and logical security are part of Information security. It is different and superset of other forms of security such as IT security which primarily deals with the security of Information stored and processed on computers or Cyber Security that primarily deals with Security of Information that resides in Cyber space.

In most projects, since a lot of Information/data pertaining to project management processes, various inputs and outputs of these processes and products, services or results of the project may be generated or processed during the project duration and many such Information may be spoken, digital, paper based, or may exist in audio or video format and if any such information is sensitive in nature for both performing and requesting organisations, then security of all such project and product information becomes important and one of the primary responsibilities of PM and PM team at least until the Project is completed. In this context, having some well defined processes pertaining to the security of sensitive project and/or product information together with various inputs, tools & techniques that a PM and PM team may use can help PM and PM team in effectively managing the security of all sensitive information pertaining to the project or its products/results.

Once again, I believe that security of all sensitive information generated/used during a Project duration is directly PM and PM team’s responsibility and they may be contractually bound to take care of security requirements of the sensitive project/product information irrespective of the fact that performing organisation has some in-house dedicated security organisation or has no such setup and culture in place. Depending upon Information Security process requirement, a PM can always request services of an external SME.