This talk helps project leads and buyers think about information security from the start, not as an afterthought. The guidance links it to classification, data protection and supplier controls.

Effective Training Talks

This training talk is supplied in fully editable MS Word format, prepared using the F-Q7 Training Talk Attendance Record form template. All text is in Calibri font for improved readability.
The following document labelling is included in the footer:

• Talk number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested training talks. No junk, jargon or unnecessary content. Simple and usable training material developed over 25 years through practical use in the real world.

Further Reading

Further guidance on project and supplier information security:

• Supplier and Third-party Information Security
• Managing Information Security Risks
• Data Protection and UK GDPR
• Information Security knowledge base

Logo Update Service

Download this training talk with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

These files are included in the alphaZ subscription. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Need Help Implementing?

If you'd like hands-on help preparing your information security risk assessment and treatment plan, including supplier and outsourcing risks, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Secure Project Management and Outsourcing Training Talk

A training talk on secure project management and outsourcing for project leads, managers and staff who engage suppliers - building information security into project planning, reviewing the information involved and controlling outsourced work. The download gives you a one-page attendance record with the talk description already filled in, plus the full guidance document to run the talk from.

Two Files in One Download

• TT-8-05 Secure Project Management and Outsourcing - the attendance record, with the topic and talk description ready to use and a signature line for each attendee
• GG-8-05 Secure Project Management and Outsourcing - the guidance document the talk is based on, to prepare from and to issue to staff afterwards

Talk Description

• Why information security is part of every project
• Including information security in project planning
• Reviewing the information involved - classification, access, transfer and storage
• Data protection impact assessments where personal data is involved
• The information security risks of outsourcing work
• Controls when outsourcing - key suppliers, confidentiality agreements and contracts

Running the Talk

Read through the guidance beforehand, talk the points through with the team, then have everyone sign the record. Keep the signed record as evidence that the briefing took place and who received it.

Why Security Belongs in Project Planning

Decisions about where information is stored, who can see it and how it is shared are usually made early in a project, and they are harder to change later. The talk puts information security into the planning stage so those questions are asked before work starts or a supplier is engaged.

Adapting the Talk

Both files are fully editable, so add your own project process, your key suppliers and the confidentiality agreement or contract terms you use when outsourcing. Update the talk description if you cover extra points.

Keeping the Training Record

File the signed record with your training records, or log the talk against each attendee in a training matrix, so you can show who has been briefed and when.

Who Is It For?

Project leads, managers and anyone who arranges outsourced work or selects suppliers. It works before a project starts, when outsourcing is planned and as a refresher for project teams.

Included in the ISO 27001 and ISO 22301 Toolkits

This training talk is part of the ISO 27001 and ISO 22301 toolkits, and is included in the integrated toolkits that combine them.

Related Training Talks

Other training talks that work alongside this one:

• TT-8-07 Information Classification and Protection
• TT-8-06 Information Transfer
• TT-8-01 Information Security - General
• TT-1-16 Data Protection