Risk Assessments for Changes and Projects
Risk management throughout the change and project life cycle
Risk often arises in the transitions: when roles change, systems are migrated, suppliers are brought in or temporary solutions are put into use. We therefore follow the change from concept and decision through to implementation, handover and stable operations.
Risk management is linked to the project's phases, milestones and decision gates. In larger or security-critical projects, we can fill the role of project security manager and ensure traceability between assets, requirements, measures, non-conformities and accepted residual risk.
Our teams combine project and change management, BIA, digital security and continuity. This enables us to handle technical, organisational and human consequences alike, and to align digital changes with relevant NIS2 requirements.
The assessment may include
- clarification of the purpose, scope, deliverables, phases, decision points, stakeholders and acceptance criteria of the change or project
- mapping of affected assets, critical functions, processes, roles, systems, locations, suppliers and dependencies
- establishment of risk ownership, project security roles, responsibility, authority, reporting lines and escalation criteria
- assessment of risk in the choice of concept and in alternative solution models before key commitments and investments are decided
- BIA-based assessments of prioritised activities, consequences over time, minimum requirements, resource requirements, dependencies and recovery objectives
- assessment of transition risk, parallel operation, data migration, relocation, test environments, temporary solutions and periods of reduced capacity or control
- mapping of organisational consequences, changed roles, authorities, work processes, competence needs, staffing and deputy arrangements
- a plan for involvement, communication, training, participation, reception and support for the managers and employees affected
- security requirements for procurements, development, architecture, integrations, suppliers, subcontractors and the operating model
- assessment against relevant NIS2 requirements for governance, incident management, continuity, the supply chain, the system life cycle, vulnerability handling and the effectiveness of controls
- establishment of a security plan for the project with milestones, control points, documentation requirements, tests, non-conformity handling and decision gates
- ongoing updating of the risk and decision log when there are changes in scope, solution, schedule, cost, organisation or threat landscape
- independent quality assurance, maturity or gap assessment and verification of whether assumptions and security requirements have actually been met
- emergency preparedness, continuity and rollback plans in case the implementation fails or has unacceptable consequences
- final assessment before go-live, relocation or handover, with documented acceptance of residual risk at the right level
- transfer to the line organisation with ownership, operating routines, competence, documentation, performance indicators and a plan for post-implementation evaluation
What does the organisation receive?
The organisation receives an updated basis for decision-making and a practical structure for managing security throughout the change. The deliverable may include a risk register, BIA results, a requirements and control matrix, a project security plan, a decision log, a communication and change plan and an emergency preparedness or rollback plan. On handover, the line organisation receives clear ownership, the necessary competence and updated documentation.
← Back to Security Act and Risk Analysis