Projects and launch decision

Create a project, appoint the security reviewer and decision maker, review deliverables and record the security opinion, then the launch decision.

Access: member. The register depends on your plan. Review actions are reserved for the security reviewer and the launch decision maker appointed on the project, with the edit right on the record.

Language: these screens are not yet translated into English. Labels below translate the French interface.

A project (IT project, business change, event, acquisition…) is a file whose security is tracked up to the launch decision. Do not confuse it with an action plan, which groups actions to carry out: see Action plans and actions.

Create a project

1. Open Registers → Projects, then New project (or the menu + shortcut).
2. Identity: name, type (IT project, Business change, Event, Acquisition, Other), sponsor, progress (Planned, In progress, Delivered, Cancelled), criticality, start date, target launch date and description. Dates can stay To be defined.
3. Context (optional): Security reviewer and Launch decision maker, two different people; required deliverables (Security questionnaire, Risk analysis, Architecture review, Vendor assessment, GDPR review). A dismissed deliverable needs a justification.
4. Access (optional): choose who can view or edit the record. You remain its administrator.
5. Summary, then create the record.

Read the record

Tab	Content
Overview	Identity, sponsor, dates, security stage, opinion and decision.
Security	Deliverables, prerequisites and commitments, decision history.
Applications	Applications delivered or changed by the project.
Risks and actions	Associated records: risks, exemptions, actions, assessments…
Access	Authorized people and teams (Read, Edit, Administration).

Follow the security stages

Stage	Expected	Action
To qualify	Appoint the participants and confirm the required deliverables.	The security reviewer selects Start review.
Under review	Complete the reviewed items, have deliverables reviewed, record the opinion.	The reviewer selects Give security opinion: Favorable, Favorable with reservations or Unfavorable.
To decide	Examine the opinion, prerequisites and residual risks.	The decision maker selects Decide on launch: Launch authorized or refused, ticking the explicit acceptance of residual risks.
Follow-up	Track remaining commitments after launch.	The decision maker or sponsor selects Close the file: assessment and operational follow-up owner.
Closed	Risks and actions still open continue to be tracked.	—

At the To decide stage, or after a refusal, the reviewer can Resume review. The decision maker or sponsor can Cancel the project as long as it is neither closed nor cancelled; the history remains available.

Review deliverables and prerequisites

In the Security tab:

• For each deliverable, fill in the Reviewed items and references, save, then Mark as reviewed.
• Add a prerequisite: a measure to carry out, flagged or not as Blocking before launch. A blocking prerequisite must be met or covered by an approved, active exemption linked to the file.
• A commitment remaining after launch must be linked to an action of the file, with an owner and due date.

After an opinion or decision, editing the record opens a new revision to review. Each opinion, decision, revision, closure or cancellation is kept in the history, with the reviewed scope.

Associate records and assess

The Applications and Risks and actions tabs offer Associate a record, Add an action, Assess and Reuse an assessment, as on an application. Project assessments are also listed under Assessments → Project assessments. See Assessment types.

Expected outcome

The project carries a traced security opinion and launch decision, with prerequisites met or covered, then it is closed with an operational follow-up owner.

Common issues

• Review action missing: only the appointed security reviewer and decision maker, with the edit right, see the actions of their stage.
• Reviewer and decision maker must be appointed before the review starts: complete Context, confirm at least one required deliverable and justify each dismissed one.
• Same reviewer and decision maker refused: choose two different people.
• Opinion refused: mark each required deliverable as reviewed.
• Launch cannot be authorized: it needs a Favorable or Favorable with reservations opinion, blocking prerequisites met or covered, and remaining commitments linked to an action (see Review deliverables and prerequisites).
• Cancellation refused: give the cancellation reason.
• The file was changed while you were typing: reload it or discard your changes before continuing.