This guidance shows how to build information security into project plans and supplier choices, with the review points, outsourcing risks and controls to use.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on supplier and project information security:

• Supplier and Third-Party Information Security
• Managing Information Security Risks
• Cloud Computing Risks and Exit Strategies
• Information Security knowledge base

How to Download

These files are included in the alphaZ subscription. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Need Help Implementing?

If you'd like hands-on help building information security into your projects and supplier checks, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Secure Project Management and Outsourcing Guidance

A general guidance document on secure project management and outsourcing, for anyone who manages projects or selects and manages suppliers. It explains why information security belongs in every project plan, what to consider when reviewing it, the information security risks of outsourcing, and the controls that reduce them.

Topics Covered

• Projects and information security - what a project is, and why information security is part of every project plan whatever its size
• Why it matters - examples of what happens when information security is left out of a project plan or supplier selection
• Building it into projects - adding information security to the development procedure and project planning templates, and training everyone who manages projects
• Reviewing a project - the points to consider, from information classification, access, transfer and storage to whether a data protection impact assessment is needed
• Risks of outsourcing - suppliers unaware of the company's requirements or their own obligations, lacking controls, leaking information or working without a contract
• Controls when outsourcing - checked suppliers, sharing the relevant policies, non-disclosure agreements, binding contracts where risk is high, and supplier audits

Who Is It For?

Anyone who plans or manages projects, and anyone involved in selecting, contracting or managing suppliers and service providers.

Included in the ISO 27001 and ISO 22301 Toolkits

This guidance is supplied with the TT-8-05 Secure Project Management and Outsourcing training talk, which is part of the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Using the Guidance

Issue it to project managers and staff who deal with suppliers, go through it with the matching training talk, and keep it as a reference when a project or outsourcing arrangement starts. Record who has received it, for example on the training matrix.

When Security Is Left Out

Short examples show the impact when information security is missed. In one, a client database is hacked through a vulnerability nobody considered and personal information is leaked. In another, a supplier chosen without checking its information security controls lets critical company information reach competitors. Each makes the case for considering information security from the start.

Adapting the Guidance

Edit the guidance to match your own arrangements - your development procedure and project planning template, how suppliers are checked and approved, and the agreements and contracts you use with suppliers.

Related Documents

Other documents that work alongside this guidance:

• PP-8-08 Secure Development Policy Procedure
• PP-8-11 Information Technology Outsourcing Policy Procedure
• PP-8-12 Information Classification and Protection Policy Procedure
• P-37 Supplier Security Policy
• F-Q21 Data Transfer and Processing Agreement
• F-Q97 Data Protection Impact Assessment
• GG-8-06 Information Transfer