Project Management
Starting from a sound technical foundation, information assurance (IA) professionals must hone their management skills. IA experts need to be competent in project management, team building, business justification, defining usable metrics, creating security frameworks, applying regulatory knowledge, managing client/vendor relations and managing problems. This series of articles on the Information Assurance Professional’s Toolkit reviews what C-level executives want to see in their IA employees and IA consultants.
Security consultant Gordon Merrill begins a series on fundamental management tools for IA professionals in general and IA security consultants in particular. His insights and recommendations will also help clients choose consultants wisely and judge their performance appropriately.
* * *
The Chief Information Security Officer (CISO) or Chief Information Officer (CIO) will likely be the primary person you will deal with in IA projects or in an effort to sell a potential client on hiring you as a private consultant. Before either one will want to let you be a part of any security project in their company, she will want to know how capable and knowledgeable you are about working within a project management structure. As a consultant, you will probably not manage the project but will be a principle part of the team and a subject matter expert (SME) in at least one area of the project. As an employee, you may more often be a project manager.
Smaller companies may bring you in as a consultant to look at a security project for them and may be so overwhelmed by the project that they ask you to manage the entire project for them. In such a case, you will probably have a larger task in front of you than working as an SME for a corporate project. The client may have little or no previous direction or standard for a security framework, making your proposal to the client larger and more involved than originally surmised. This kind of project will call on several other skills, to follow in this series, beyond project management.
In every contract and every endeavor you undertake as a consultant, whether you are a private consultant or work for a company, each project must be treated as a complete process with documentation, planning, resource planning and budgeting
An excellent reference for project management of all kinds is the Project Management Institute’s Fourth Edition of A Guide to the Project Management Body of Knowledge (PMBOK® Guide).
In the next part, Gordon discusses team building.
* * *
Merrill, MSIA, currently lives and works in Tennessee. His career has taken him to 48 of the 50 states and to six foreign countries. His information assurance background has included working for major computer companies such as IBM, managing IT projects for Fortune 250 companies in the risk management field, owning his own business, and working as a private consultant. You may contact him by e-mail.
This series is based on some of the papers Merrill wrote during his MSIA Program at Norwich University from 2007 through 2008. Merrill and I have collaborated closely in rewriting his research for this series.
