[Project Name] Planning: Security and Risk Plan

Instruction This document is used to define the technology-related risks and security needs associated with NUIT projects. This document outlines the process by which risk and security needs are assessed and includes a sample Risk Analysis Questionnaire. The data collected with the attached questionnaire will provide insight to the project manager and project team as to the level of involvement Information Security will have on the project. Specifically, this will raise security awareness within project team and avoid the need for Information Security staff from attending all project meetings and reading detailed project documentation.

Procedure As soon as the project enters the planning phase the Risk Analysis Questionnaire should be completed. The questionnaire is included as page 2 of this planning document.

Completing the Questionnaire Effective use of the questionnaire presumes a comprehensive understanding of the value of the systems and information being assessed. When determining the value, consider any laws, regulations, policies or standards that establish specific requirements for integrity, confidentiality, authenticity, and non-repudiation of data and information in the system.  Confidentiality – The information requires protection from unauthorized disclosure.  Integrity – The information must be protected from unauthorized, unanticipated, or unintentional modification. This includes, but is not limited to:  Availability – The information technology resource (system or data) must be available on a timely basis to meet mission requirements or to avoid substantial losses. Availability also includes ensuring that resources are used only for intended purposes. Consider the information processed by the system and the need for protective measures. Reference the Business Impact Analysis Workshop document for recovery time frames.

Data Analysis Send completed questionnaire to the Information Security Office BEFORE creating the project plan.

Date Printed: 6/9/2018 Page 1 of 4 File Name: 0c5fd879aec3d9f616a2699fc2b400a0.docx NUIT Confidential Document Tracking Date Action Taken By Whom Technology Risk Analysis Questionnaire

Project Number and Title:

Responder:

Date:

QUESTION YES NO Is the project requesting a modification to established information security policies or standards? (Implication: 1. Any change in the information security controls must be reviewed for impact across the enterprise). If “YES”, provide details. Does this project cut across multiple lines of business in a new or unique manner for which no approved security requirements or design 2. models exist? (Implications: One business unit cannot put another at risk without both parties knowing it and allowing it to occur.) If “YES”, provide details. Does this project include applications and information with regulatory compliance significance (or other contractual conditions that must be formally complied with) in a 3. new or unique manner for which no approved security requirements or design models exist? (Implication: Noncompliance with regulations and contractual commitments can incur penalties.) If “YES”, provide details. Does this project have privacy implications because of the use of customer or internal personnel information? (Implication: Protecting personal information of customers and 4. employees is mandated by many laws, rules, and regulations. Not complying with such requirements could result in punitive damages being applied to the enterprise and lawsuits form affected parties.) If “YES”, provide details. Is there new technology involved, never before used by the organization? (Implication: New technology can introduce new information security risk into the enterprise. 5. Identifying that risk must be done early in the project to provide time to research mitigating controls or delay the project.) If “YES”, provide details. 6. Does this project include third-party service providers conducting business on behalf of the organization? (Implication: The use of third-party service providers can introduce Please send completed questionnaires to the Information Security Office. QUESTION YES NO new information security risk into the enterprise and into the overall business process. That risk must be identified early in the project to provide time to assess the other party’s information security processes and mitigating controls, introduce contractual requirements such as acceptance of liability in the event of a security breach introduced through either party, research and implement additional mitigating controls on all sides, or delay the project.) If “YES”, provide details. Will this project involve a major change to the IT infrastructure? (Implication: A change to the established infrastructure could mean a change in the information security 7. architecture and implementations. Changes to processes, procedures and mitigating controls might be required because of the infrastructure change.) If “YES”, provide details. Will there be a need to modify established identity and access management processes and infrastructure? (Implication: Business process changes often indicate changes to the 8. access control infrastructure. Not applying such changes can put the enterprise at risk of unauthorized access.) If “YES”, provide details. Will this project have an impact on current business continuity, disaster recovery processes and infrastructure? (Implication: Changes in business and IT processes and 9. infrastructure often make established business continuity and disaster recovery plans out of date. Not applying changes to the enterprise’s recovery plans and infrastructure puts the enterprise at risk in the event of an interruption in the normal business process.) If “YES”, provide details.

Please send completed questionnaires to the Information Security Office.