# Projects and launch decision

Create a project, appoint the security reviewer and decision maker, review deliverables and record the security opinion, then the launch decision.

> **Access:** member. The register depends on your plan. Review actions are reserved for the **security reviewer** and the **launch decision maker** appointed on the project, with the edit right on the record.
>
> **Language:** these screens are not yet translated into English. Labels below translate the French interface.

A project (IT project, business change, event, acquisition…) is a file whose security is tracked up to the launch decision. Do not confuse it with an **action plan**, which groups actions to carry out: see [Action plans and actions](https://docs.cisapp.eu/en/collaboration/projects).

## Create a project

1. Open **Registers → Projects**, then **New project** (or the menu **+** shortcut).
2. **Identity**: name, type (IT project, Business change, Event, Acquisition, Other), sponsor, progress (Planned, In progress, Delivered, Cancelled), criticality, start date, target launch date and description. Dates can stay **To be defined**.
3. **Context** (optional): **Security reviewer** and **Launch decision maker**, two different people; required deliverables (Security questionnaire, Risk analysis, Architecture review, Vendor assessment, GDPR review). A dismissed deliverable needs a justification.
4. **Access** (optional): choose who can view or edit the record. You remain its administrator.
5. **Summary**, then create the record.

## Read the record

| Tab | Content |
|---|---|
| Overview | Identity, sponsor, dates, security stage, opinion and decision. |
| Security | Deliverables, prerequisites and commitments, decision history. |
| Applications | Applications delivered or changed by the project. |
| Risks and actions | Associated records: risks, exemptions, actions, assessments… |
| Access | Authorized people and teams (Read, Edit, Administration). |

## Follow the security stages

| Stage | Expected | Action |
|---|---|---|
| To qualify | Appoint the participants and confirm the required deliverables. | The security reviewer selects **Start review**. |
| Under review | Complete the reviewed items, have deliverables reviewed, record the opinion. | The reviewer selects **Give security opinion**: Favorable, Favorable with reservations or Unfavorable. |
| To decide | Examine the opinion, prerequisites and residual risks. | The decision maker selects **Decide on launch**: Launch authorized or refused, ticking the explicit acceptance of residual risks. |
| Follow-up | Track remaining commitments after launch. | The decision maker or sponsor selects **Close the file**: assessment and operational follow-up owner. |
| Closed | Risks and actions still open continue to be tracked. | — |

At the **To decide** stage, or after a refusal, the reviewer can **Resume review**. The decision maker or sponsor can **Cancel the project** as long as it is neither closed nor cancelled; the history remains available.

## Review deliverables and prerequisites

In the **Security** tab:

- For each deliverable, fill in the **Reviewed items and references**, save, then **Mark as reviewed**.
- **Add a prerequisite**: a measure to carry out, flagged or not as **Blocking before launch**. A blocking prerequisite must be met or covered by an approved, active exemption linked to the file.
- A commitment remaining after launch must be linked to an action of the file, with an owner and due date.

After an opinion or decision, editing the record opens a new revision to review. Each opinion, decision, revision, closure or cancellation is kept in the history, with the reviewed scope.

## Associate records and assess

The **Applications** and **Risks and actions** tabs offer **Associate a record**, **Add an action**, **Assess** and **Reuse an assessment**, as on an [application](https://docs.cisapp.eu/en/registers/applications). Project assessments are also listed under **Assessments → Project assessments**. See [Assessment types](https://docs.cisapp.eu/en/assessments/types).

## Expected outcome

The project carries a traced security opinion and launch decision, with prerequisites met or covered, then it is closed with an operational follow-up owner.

## Common issues

- Review action missing: only the appointed security reviewer and decision maker, with the edit right, see the actions of their stage.
- Reviewer and decision maker must be appointed before the review starts: complete **Context**, confirm at least one required deliverable and justify each dismissed one.
- Same reviewer and decision maker refused: choose two different people.
- Opinion refused: mark each required deliverable as reviewed.
- Launch cannot be authorized: it needs a **Favorable** or **Favorable with reservations** opinion, blocking prerequisites met or covered, and remaining commitments linked to an action (see [Review deliverables and prerequisites](https://docs.cisapp.eu/en/registers/projects#review-deliverables-and-prerequisites)).
- Cancellation refused: give the cancellation reason.
- The file was changed while you were typing: reload it or discard your changes before continuing.