This snapshot taken on 05/09/2007, shows web content selected for preservation by The National Archives. External links, forms and search boxes may not work in archived websites.
A project fails if it does not meet its IA objectives, since the information delivered by the service and upon which the business relies may not be adequately protected.
Furthermore, a requirement for accreditation has the capability to significantly impact a project, usually at a late stage, if it is not correctly managed.
Careful ongoing monitoring of the project-related risks associated with the IA requirement is a necessary precursor to successful procurement management.
Consideration of IA issues in a procurement must always be conducted with a clear view of its purpose, which is to ensure an appropriate level of Information Assurance in the delivered service.
This can only be achieved by treating the IA requirements applying to the system or service as an integral element of the business throughout the entire procurement process.
There are a number of principles of governance relating to this process:
Programmes and procurement projects in Central Government are subject to OGC Gateway(TM) Reviews. The process is recommended here as best practice.
The OGC Gateway(TM) process examines programmes and projects at critical stages in their lifecycle to provide assurance that they can progress to the next stage. There are five OGC Gateway(TM) Reviews during the lifecycle of a project, three before contract award and two looking at service implementation and confirmation of the operational benefits.
IA is incorporated into the OGC Gateway(TM) process, which states explicitly that for IT enabled projects:
The formal relationship between IA, accreditation and the Gateway(TM) process is fully defined in HMG Infosec Standard No 2.
This section of the framework does not seek to replace that guidance, but offers some practical experience on the critical points to address, in relation to service based procurements.
At this point the main focus is on preparation - the development of a sound business case.
In practical terms the key factors for IA are to confirm the involvement of relevant external agencies (CPNI for example where the project forms part of the Critical National Infrastructure), and to ensure that the IA aspects are feasible and that costs and major project risks arising from IA have been identified. This may involve the production of a high level set of IA requirements even at this very early stage.
Wherever relevant the IA factors must be taken into account in Value for Money assessments.
It is also important from a very early stage to ensure that project-related risks and issues arising from IA are visible, by ensuring that:
In practical terms, the key factor in IA at this point is to ensure that the requirements have been specified in a way which is appropriate to the procurement.
Current HMG security documentation standards are based on a model in which a security policy statement is produced at an early stage. In some cases this is not possible; for example in a service-based procurement. In these cases it can be difficult to specify the IA requirements in a way which does not also specify the way in which they will be delivered.
The overall aim for service related procurements should be to place the emphasis on the supplier to meet the necessary standards, but to retain visibility in order to be able to manage project risk.
Ensure that there is an IA requirements statement (an RMADS) in place so that the Accreditor can be briefed, and so that the risk to the programme is reduced. In the case of service based procurements this will need to be developed by the supplier.
Ensure that there is a plan for achieving security in the end service, which is credible, realistic, monitored and adjusted where necessary, and ensure that it ties in with the overall plans for the project.
When assessing competing proposals (before entering the third gateway) the usual process is to construct an agreed set of criteria and assess each proposal against those criteria (so-called ‘weight and rate’). When constructing criteria for security appraisals, organisations may wish to adopt a model developed for use as part of the DERA (QinetiQ) security domains approach:
Part of the ‘readiness for service’ assessment will include confirmation of accreditation. Where qualified accreditation has been granted, or where accreditation has been granted on a time-limited basis, there will be risks to the business, which must be recognised and managed.
It is vital to consider IA in the context of the supporting processes, particularly aspects such as change control, and in terms of the effectiveness of the management structure.
Gateway(TM) review 5 is concerned with project closure. The termination phase has a number of important IA aspects, mostly relating to the maintenance of control during project termination.
However, the gateway is primarily aimed at reviewing the benefits gained.
Security should not be forgotten in any benefits evaluation. Just as with any aspect, there will be lessons learned, and there is potential for a contribution to the post implementation review.
Departments are strongly advised to appoint as part of the project team, an individual such as the System Manager, with responsibility for co-ordination of security, so that the project risk arising from IA requirements can be owned and managed.
There should be a Security Working Group established which can monitor and track IA issues.
All security related deliverables must be identified, have acceptance criteria associated with them, and have delivery timescales.
HMG Standards
As noted elsewhere in this document, the relevant HMG security standards apply not only to the target system but also to any related environments such as project office networks.
Gateway(TM) reviews must ensure adherence and application of the appropriate standards at each stage. The conduct of a residual risk calculation in accordance with HMG Infosec Std No 1 Residual Risk Assessment Method (IS1) is a mandatory part of the RMADS in the case where protectively marked information is being processed. In such cases, interconnections between business domains may also need to be assessed in accordance with HMG Infosec Std No 3 Connecting Business Domains (IS3).
ISO/IEC 17799
The standard applies to the management environment rather than specifically the project or procurement process. Nevertheless some aspects of the standard should be borne in mind: