Insights · Security
When a growth project needs a security review
Selling to large customers, handling personal data or connecting a plant can each change what a project has to prove. The earlier you see it, the cheaper it is to answer.
Most growth projects start with a simple goal: sell more, serve more customers, or run more of the work through software. Partway through, a question often comes up that nobody planned for. A buyer asks for proof of security. A regulator asks where personal information is kept. An operations manager wants a new system to talk to the plant floor. The project can usually continue, but it needs a security review first.
Selling to large customers
Large organizations and government buyers often send a security questionnaire before they sign. They may ask about access controls, backups, incident response and where information is stored. If the answers are vague, the sale slows or stops. Find out what these buyers will ask while the sales plan is being written, not after the proposal has gone out.
Handling personal data
A new tool that collects customer or employee information changes your privacy obligations. Canadian federal and provincial privacy laws set rules for how personal information is collected, used, stored and deleted. Agree those rules at the start of the project, before the data begins to flow. Changing them after launch costs more and carries more risk.
Connecting a plant
When a system reaches into a plant, the risk changes. Production equipment is often built to run for years without updates, and it was not designed for a network full of threats. A link between office systems and plant equipment can open a path that did not exist before. Map the boundary between the two networks, and agree who is responsible for each side, before anything is connected.
What to do before the build starts
Name the requirement early. Ask which buyers, regulators or insurers will ask for what, and in what form. Put the review in the plan, with time and budget in the schedule rather than added at the end. And get an independent view. Specialists see the gaps that a project team, focused on its goal, can miss.
A question asked before the build is far easier to answer than the same question asked after launch, when the deal or the plant is already waiting on the answer.
At NLM Cognitive Solutions, we spot these points in the business case and the plan, and we raise them with you early. For the security work itself, we bring in FlintLever, the security and compliance company of our group. FlintLever runs security assessments for IT and OT, prepares organizations for certifications such as CyberSecure Canada, and designs secure systems. Both brands belong to FlintLever Inc., so the handover is simple.
NLM Cognitive Solutions
To discuss this article or your own situation, write to hello@nlmcognitive.com.