Impact of Health Reform on Healthcare Organization and Management
This content delves into the impact of health reform on healthcare organization and management, discussing issues like healthcare costs, uninsured populations, disparities, quality of care, and the relationship between employment and healthcare. It also addresses the challenges and changes brought about by the Affordable Care Act (ACA) and explores the dynamics of the healthcare system in the U.S. in terms of access, cost, and outcomes.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Information Security in the Project Delivery Framework Bridget Kenyon Daniela Cooper
What were covering Introduction Project Manager Responsibilities How Information Security fits into the PDF Project Stages and Gates The Requirements and Expectations document The Capability document The Risk Treatment Plan How ISG can support you
Introduction Why Information Security? Manage costs Ensure that products and processes are suitable Manage risk of information security incidents
Introduction (2) How does information security fit into project management? Addresses risk to information handled or affected by: The project Its deliverables (e.g. Print@UCL service) Project assurance for information risk management
Introduction (3) The approach tailored to the project 3 classifications of project, based upon its information risk: Level 1 low risk Level 2 medium risk Level 3 high risk Classifications determine: amount of work required to manage information risk level of resources (i.e. time) required from ISG Level 3 projects may have dedicated information security work packages
Project Manager Responsibilities 1. Assess risks Information Risk documents 2. Identify the risk owner(s) 3. Maintain a risk register 4. Maintain a risk treatment plan 5. Hand out actions to manage risk 6. Monitor risk
Information Security in the PDF All projects need to go through the risk assessment process Information Risk documents www.ucl.ac.uk/informationsecurity - on right hand side Information Risk Management Guiding Principles Fill in the documents yourself Contact ISG for a meeting to discuss ISG available for help and advice
Project Stages and Gates Pre-Project ISG involved in reviewing all proposals Start-up Requirements & Expectations doc to be completed Project Initiation Projects with risk rating of 2 or 3 to complete Capability doc and risk treatment plan Our involvement after Project Initiation depends upon project information risk level
Project Documentation Project Bid Proposal Information security risk analysis (data classification) Known information security risks and requirements High Level Design document Information risk management guiding principles Project Initiation document Section 5 Information Governance, Information Security and Data Protection Information risk management documents
Project Bid Proposals What we check for: Completeness, data classification, testing budget, resources required from ISG, ongoing security ISG assigns project to a category: Low risk, ISG needs to be involved, not filled in, inconsistent/data missing, major problem with bid
What is the Requirements and Expectations document? Classifies information to be used or affected by the project Determines requirements of the information for protection Identifies internal or external requirements for information security which impact the project Provides initial classification of project (1 or 2/3)
The Requirements and Expectations document 30 minutes to an hour depending on the type of project Information classification secret, highly restricted, restricted, normal Level of concern for: confidentiality, integrity, and availability Internal and external requirements Penetration testing requirements
Activity One Handouts Scenario Requirements and Expectations Extract Instructions Using the scenario, classify the information that will be used and/or affected by the project.
What is the Capability document? Required for Level 2 or Level 3 projects Provides final classification of project Assesses the current plans for the project Identifies any concerns Rates risks Used to identify discrepancies between capability and requirements
The Capability document Around an hour maybe a little longer if it s a big project Project context How information is stored, processed, transmitted Fill in section on risk scenarios, this includes: working out the likelihood and impact of each risk before controls, with current controls, with proposed controls proposed controls to mitigate each risk 10 standard risks Project capability rating
Activity Two Handouts Scenario Capability Extract Instructions Using the scenario, list some possible example risks and have a go at rating the likelihood and impact of the risk.
Project Risk Rating Projects assigned a risk level Level 1 PM keeps an eye on it + will reassess if something changes Level 2 ISG consulted throughout process Level 3 ISG involved in the project team May need a dedicated information risk management work package
The Risk Treatment Plan Risks and controls from the Capability document are transferred to the risk treatment plan Risk before treatment including risk rating Risk treatment detailing: Controls to prevent the event, detect the event, react to the consequences Risk after treatment including risk rating Risk owner approval
How ISG can help you Advice and support on the risk assessment process Auditing of project information risk management Technical testing Servers and web applications
Thanks for listening! Questions?
