CIR PM Cyber Security Specific Scopes

Cyber Security Scope

The scope of a project is developed so that the team remains focused (Goh, 2008c) on the tasks at hand determined by appropriate assumptions and limitations. Without a defined scope, the project team is unclear about the outcome and may waste resources performing unnecessary actions.

The established scopes should not be too broad but practical and realistic so the project team can maintain control and not go too overboard. The input from the BCM team may be helpful at the start of this initiative.

During this project management (PM) phase, objectives are established for the cyber security program development components as stepping stones for the organization to achieve the scope developed. Specific tasks required to be performed are identified, producing certain deliverables to meet these objectives.

For example, the scope can be “to ensure that the organization is well protected against different cyber security threats”. Hence, objectives to meet this scope can include identifying and documenting potential cyber security threats that can attack the organization and developing mitigation measures to protect the organization from such attacks.

Responding measures should the organization be attacked. From the objectives, tasks are identified to fulfil them, such as researching and gathering information or meeting with respective departments to find out what they require. Ultimately, deliverables (identified cyber security threats and measures) are produced, and the objectives and scope are fulfilled.

Cyber Security Specific Scopes

Looking at how the main aim of a cyber security program is to protect the organization from cyber security threats, the scope of the program can be defined in three simple sets of actions; namely, preventive, responsive, and corrective actions.

1. Preventive Actions

Prevention is the best cure. When the organization develops preventive measures, it shields itself from potential attacks.

2. Responsive Actions

The organization develops procedures to allow efficient responses to cyber security attacks. An effective response strategy minimizes the associated impacts.

3. Corrective Actions

After the cyber security incident has been resolved, the organization needs to review its cyber security plan. Gaps and loopholes have to be identified and rectified to prevent a similar incident from occurring.

Related Topics for CIR Project Management

5.5.1 Cyber Security Specific Scope	5.6 Scenario Development	5.7.1 BCM Team Structure for CIR	5.7.2 Cyber Security Team Structure
5.8 BCM and Cyber Security Framework	5.9 Relationships Between the BCM & CIR Structures	5.10.1 Relook at Existing Structure and Initiatives

Do You Want to Continue BCM Training onsite or online?

Competency-based Course		Certification Course

Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.

Reference: Chapter 5 Project Management 5.5 Scope

Note: This version was the draft 2nd Edition being updated in 2023. The numeric in the square bracket [X-X] cross-refers to the actual chapter and section in the 1st Edition.