Following-on from the preliminary phase I covered yesterday, the longest phase of most professional services engagements is the part where the services are delivered. With the contractual formalities out of the way, the supplier starts the service, providing consultancy support or specialist advice. The client receives and utilises the service. Both 'sides' are important to both parties, since a professional service that isn't delivered and used doesn't generate value for the client, and is unlikely to lead to repeat business - such as additonal assignments:
Information risk-relevant aspects that deserve proactive attention include changes, incidents, performance and quality of service, and compliance. I plan to describe basic processes associated with each of those, briefly, in the guideline. Incident management, for example, should protect the interests of client and provider both separately and together, so communication and collaboration may be key.
Maintaining management's focus on information risk during this phase may involve:
- Opportunistically pointing out information risk-related concerns, issues with controls, compliance obligations, improvement opportunities etc.;
- Incorporating information risk and security metrics into reporting (begging the question 'What metrics?');
- Making information risk a standing agenda item for relationship management meetings, progress meetings, project meetings or whatever;
- Emphasizing mutual interest in minimizing incidents, wherever possibly collaborating to reduce the probability and impact;
- Reviews and audits to confirm the effectiveness of key controls, identify concerns and provide assurance.
SOCIAL SHARE CARD GENERATOR