Security Project Planning Flashcards

A security project manager needs to document the boundaries and deliverables of a new security initiative. Which planning artifact is most appropriate for this purpose?

Answer: Project scope statement

A project scope statement defines boundaries, deliverables, exclusions, and acceptance criteria for the security project.

During security project planning, the team identifies that a critical firewall upgrade depends on a network assessment being completed first. This relationship is best described as a:

Answer: Finish-to-start dependency

A finish-to-start dependency means the predecessor activity must finish before the successor activity can start.

Which security planning document establishes the processes for managing changes to security controls during a project?

Answer: Change management plan

The change management plan defines procedures for submitting, reviewing, approving, and implementing changes throughout the project.

A CSPM candidate is estimating security project costs using historical data from similar past projects. This technique is called:

Answer: Analogous estimating

Analogous estimating uses historical information from similar projects to estimate duration or cost.

Which of the following is the PRIMARY purpose of a security project kickoff meeting?

Answer: Formally authorize the project start and align stakeholders

The kickoff meeting formally signals the start of execution and ensures all stakeholders share a common understanding of goals and expectations.

When planning a security awareness training program project, the manager should capture both internal and external stakeholders using which tool?

Answer: Stakeholder register

A stakeholder register documents all identified stakeholders, their roles, interests, and influence on the project.

In security project planning, 'gold plating' refers to:

Answer: Adding features or functionality beyond what was agreed in scope

Gold plating is the practice of adding extras not requested by the customer, which can increase risk and cost without adding approved value.