This talk helps project leads and buyers think about information security from the start, not as an afterthought. The guidance links it to classification, data protection and supplier controls.
This training talk is supplied in fully editable MS Word format, prepared using the F-Q7 Training Talk Attendance Record form template. All text is in Calibri font for improved readability.
The following document labelling is included in the footer:
- Talk number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested training talks. No junk, jargon or unnecessary content. Simple and usable training material
developed over 25 years through practical use in the real world.
Further guidance on project and supplier information security:
Download this training talk with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
If you'd like hands-on help preparing your information security risk assessment and treatment plan, including supplier and outsourcing risks, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Secure Project Management and Outsourcing Training Talk
A training talk on secure project management and outsourcing for project leads, managers and staff who engage suppliers - building information security into project planning, reviewing the information involved and controlling outsourced work. The download gives you a one-page attendance record with the talk description already filled in, plus the full guidance document to run the talk from.
Two Files in One Download
- TT-8-05 Secure Project Management and Outsourcing - the attendance record, with the topic and talk description ready to use and a signature line for each attendee
- GG-8-05 Secure Project Management and Outsourcing - the guidance document the talk is based on, to prepare from and to issue to staff afterwards
Talk Description
- Why information security is part of every project
- Including information security in project planning
- Reviewing the information involved - classification, access, transfer and storage
- Data protection impact assessments where personal data is involved
- The information security risks of outsourcing work
- Controls when outsourcing - key suppliers, confidentiality agreements and contracts
Running the Talk
Read through the guidance beforehand, talk the points through with the team, then have everyone sign the record. Keep the signed record as evidence that the briefing took place and who received it.
Why Security Belongs in Project Planning
Decisions about where information is stored, who can see it and how it is shared are usually made early in a project, and they are harder to change later. The talk puts information security into the planning stage so those questions are asked before work starts or a supplier is engaged.
Adapting the Talk
Both files are fully editable, so add your own project process, your key suppliers and the confidentiality agreement or contract terms you use when outsourcing. Update the talk description if you cover extra points.
Keeping the Training Record
File the signed record with your training records, or log the talk against each attendee in a training matrix, so you can show who has been briefed and when.
Who Is It For?
Project leads, managers and anyone who arranges outsourced work or selects suppliers. It works before a project starts, when outsourcing is planned and as a refresher for project teams.
Included in the ISO 27001 and ISO 22301 Toolkits
This training talk is part of the ISO 27001 and ISO 22301 toolkits, and is included in the integrated toolkits that combine them.
Related Training Talks
Other training talks that work alongside this one:
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan