Project Management Plan

This project management plan outlines the scope, objectives, and deliverables of a software development project. The project will be executed in five phases: review help documentation, incorporate help documentation, develop user manuals, pilot, and deployment. Each phase has specific tasks, timelines, and responsible personnel. The project will involve various stakeholders, including sponsors, managers, analysts, developers, testers, users, and network analysts. Quality management, communications management, risk management, and procurement management plans are also included. The project plan is approved by multiple signatures.

<PROJECT NAME>CYBERSECURITY AUDIT
PROJECT MANAGEMENT PLAN
Version 1.0
September/2016
[Insert appropriate disclaimer(s)]

<Project Name>
TABLE OF CONTENTS
1 INTRODUCTION.....................................................................................................................2
1.1 Purpose of Project Management Plan........................................................................2
1.2 Assumptions/Constraints............................................................................................2
2 SECURITY AUDIT..................................................................................................................2
2.1 HIPAA Risk Analysis................................................................................................2
2.2 HITECH Risk Analysis..............................................................................................2
2.3 Cyber Security Risk Assessment...............................................................................2
3 SCOPE MANAGEMENT........................................................................................................2
3.1 Work Breakdown Structure........................................................................................2
3.2 Change Control Management....................................................................................4
4 SCHEDULE/TIME MANAGEMENT....................................................................................4
5 QUALITY MANAGEMENT...................................................................................................7
6 HUMAN RESOURCE MANAGEMENT...............................................................................7
7 COMMUNICATIONS MANAGEMENT..............................................................................8
8 RISK MANAGEMENT............................................................................................................8
9 PROCUREMENT MANAGEMENT......................................................................................9
APPENDIX A: PROJECT MANAGEMENT PLAN APPROVAL........................................10
Page 1 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
1 INTRODUCTION
1.1 PURPOSE OF PROJECT MANAGEMENT PLAN
The purpose of the project is to conduct security risk assessment. There are some
challenges in the existing system which requires some overhaul.
1.2 ASSUMPTIONS/CONSTRAINTS
Assumptions related to the project are that there will be required support from the
management in doing this project. The possible constraint for this project is time which has
to be handled prudently and following the planned activities properly.
2 SECURITY AUDIT
The sub-sections ahead are concerned with the security assessment of the system based on
HIPAA, HITECH and Cyber Security areas.
2.1 HIPAA AND HITECH RISK ANALYSIS
The table below shows the risk assessment for HIPAA and HITECH:
Security Component Vulnerabilities Security Mitigation
Strategies
Administrative Safeguards No security officer is
designated
Workforce is not trained
Assign designated security
officer
Begin workforce training at
hire
Physical Safeguards Computer equipment is easily
accessible by the public
Facility has insufficient locks
and other barriers to patient
data access
Lock offices when not in use
Put screen shield for
secondary viewers
Technical Safeguards Poor controls allow
inappropriate access to
information
No measures in place to keep
electronic patient data from
improper changes
Secure user id and password
Install Anti-hacking and anti-
malware software
Organizational Standard No breach notification and
associated policies exist
Regular review of agreements
conducted and updated
Policies and Procedures The manager performs ad hoc
security measures
Routine updates to be made
Page 2 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
2.2 CYBER SECURITY RISK ASSESSMENT
Threat Cause Process Control
Concern?
Demand Type Consequence
Severity
Data
Modification
Malicious
external attempt
Yes Low Demand Medium
Data Theft Malicious
external attempt
Some cyber
nodes
High demand Medium
Denial of Service Malicious
external attempt
Yes High Demand High
Malware General Virus Yes Low Demand Very High
3 SCOPE MANAGEMENT
The project scope is limited to analysis of the existing system and then
implementation of new system.
3.1 WORK BREAKDOWN STRUCTURE
Task Name
Benefits Administration Software
Scope
Determine project scope
Secure project sponsorship
Define preliminary resources
Secure core resources
Scope complete
Analysis/Software Requirements
Conduct current system assessment
Develop new requirements
Review software specifications/budget with team
Incorporate feedback on software specifications
Develop delivery timeline
Obtain approvals to proceed (concept, timeline, budget)
Secure required resources
Analysis complete
Design
Review preliminary software specifications
Develop functional specifications
Review functional specifications
Incorporate feedback into functional specifications
Page 3 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
Obtain approval to proceed
Design complete
Development
Review functional specifications
Identify modular/tiered design parameters
Assign development staff
Develop code
Development complete
Testing
Develop unit test plans using product specifications
Develop integration test plans using product specifications
Unit Testing
Review modular code
Modify code
Re-test modified code
Unit testing complete
Integration Testing
Test module integration
Modify code
Re-test modified code
Integration testing complete
Documentation
Develop Help specification
Develop Help system
Review Help documentation
Incorporate Help documentation feedback
Develop user manuals
Documentation complete
Pilot
Identify test group
Develop software delivery mechanism
Install/deploy software
Obtain user feedback
Evaluate testing information
Pilot complete
Deployment
Determine final deployment strategy
Develop deployment methodology
Secure deployment resources
Deploy software
Deployment complete
Page 4 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
3.2 CHANGE CONTROL MANAGEMENT
Change management will be handled using the Kotter’s eight change management rule. It
might be possible that individuals might not respond for the change which will be taken
care through the same.
4 SCHEDULE/TIME MANAGEMENT
Task Name Duration Start Finish Predecessors
Benefits Administration Software 165
days
Wed 17-
02-16
Wed 05-
10-16
Scope 14 days Wed 17-
02-16
Tue 08-03-
16
Determine project scope 2 days Wed 17-
02-16
Fri 19-02-
16
Secure project sponsorship 3 days Fri 19-02-
16
Wed 24-02-
16 3
Define preliminary resources 5 days Wed 24-
02-16
Wed 02-03-
16 4
Secure core resources 4 days Wed 02-
03-16
Tue 08-03-
16 5
Scope complete 0 days Tue 08-03-
16
Tue 08-03-
16 6
Analysis/Software Requirements 54 days Tue 08-03-
16
Mon 23-
05-16
Conduct current system assessment 3 days Tue 08-03-
16
Fri 11-03-
16 7
HIPAA Risk Analysis 12 days Fri 11-03-
16
Tue 29-03-
16 9
HITECH Risk Analysis 15 days Tue 29-03-
16
Tue 19-04-
16 10
Develop new requirements 5 days Tue 19-04-
16
Tue 26-04-
16 11
Review software specifications/budget with
team 4 days Tue 26-04-
16
Mon 02-05-
16 12
Incorporate feedback on software
specifications 2 days Mon 02-
05-16
Wed 04-05-
16 13
Develop delivery timeline 6 days Wed 04-
05-16
Thu 12-05-
16 14
Obtain approvals to proceed (concept,
timeline, budget) 5 days Thu 12-05-
16
Thu 19-05-
16 15
Secure required resources 2 days Thu 19-05-
16
Mon 23-05-
16 16
Analysis complete 0 days Mon 23-
05-16
Mon 23-05-
16 17
Page 5 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
Design 15 days Mon 23-
05-16
Mon 13-
06-16
Review preliminary software specifications 1 day Mon 23-
05-16
Tue 24-05-
16 18
Develop functional specifications 5 days Tue 24-05-
16
Tue 31-05-
16 20
Review functional specifications 3 days Tue 31-05-
16
Fri 03-06-
16 21
Incorporate feedback into functional
specifications 4 days Fri 03-06-
16
Thu 09-06-
16 22
Obtain approval to proceed 2 days Thu 09-06-
16
Mon 13-06-
16 23
Design complete 0 days Mon 13-
06-16
Mon 13-06-
16 24
Development 28 days Tue 31-05-
16
Fri 08-07-
16
Review functional specifications 4 days Tue 31-05-
16
Mon 06-06-
16 21
Identify modular/tiered design parameters 6 days Mon 06-
06-16
Tue 14-06-
16 27
Assign development staff 3 days Tue 14-06-
16
Fri 17-06-
16 28
Develop code 15 days Fri 17-06-
16
Fri 08-07-
16 29
Development complete 0 days Fri 08-07-
16
Fri 08-07-
16 30
Testing 29 days Fri 08-07-
16
Thu 18-08-
16
Develop unit test plans using product
specifications 5 days Fri 08-07-
16
Fri 15-07-
16 31
Develop integration test plans using product
specifications 2 days Fri 15-07-
16
Tue 19-07-
16 33
Unit Testing 13 days Tue 19-07-
16
Fri 05-08-
16
Review modular code 3 days Tue 19-07-
16
Fri 22-07-
16 34
Modify code 2 days Fri 22-07-
16
Tue 26-07-
16 36
Re-test modified code 5 days Tue 26-07-
16
Tue 02-08-
16 37
Unit testing complete 3 days Tue 02-08-
16
Fri 05-08-
16 38
Integration Testing 9 days Fri 05-08-
16
Thu 18-08-
16
Page 6 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
Test module integration 2 days Fri 05-08-
16
Tue 09-08-
16 39
Modify code 3 days Tue 09-08-
16
Fri 12-08-
16 41
Re-test modified code 2 days Fri 12-08-
16
Tue 16-08-
16 42
Integration testing complete 2 days Tue 16-08-
16
Thu 18-08-
16 43
Documentation 18 days Fri 08-07-
16
Wed 03-
08-16
Develop Help specification 3 days Fri 08-07-
16
Wed 13-07-
16 30
Develop Help system 4 days Wed 13-
07-16
Tue 19-07-
16 46
Review Help documentation 5 days Tue 19-07-
16
Tue 26-07-
16 47
Incorporate Help documentation feedback 3 days Tue 26-07-
16
Fri 29-07-
16 48
Develop user manuals 3 days Fri 29-07-
16
Wed 03-08-
16 49
Documentation complete 0 days Wed 03-
08-16
Wed 03-08-
16 50
Pilot 20 days Thu 18-08-
16
Thu 15-09-
16
Identify test group 5 days Thu 18-08-
16
Thu 25-08-
16 44
Develop software delivery mechanism 4 days Thu 25-08-
16
Wed 31-08-
16 53
Install/deploy software 3 days Wed 31-
08-16
Mon 05-09-
16 54
Obtain user feedback 5 days Mon 05-
09-16
Mon 12-09-
16 55
Evaluate testing information 3 days Mon 12-
09-16
Thu 15-09-
16 56
Pilot complete 0 days Thu 15-09-
16
Thu 15-09-
16 57
Deployment 14 days Thu 15-09-
16
Wed 05-
10-16
Determine final deployment strategy 5 days Thu 15-09-
16
Thu 22-09-
16 58
Develop deployment methodology 4 days Thu 22-09-
16
Wed 28-09-
16 60
Secure deployment resources 3 days Wed 28-
09-16
Mon 03-10-
16 61
Page 7 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
Deploy software 2 days Mon 03-
10-16
Wed 05-10-
16 62
Deployment complete 0 days Wed 05-
10-16
Wed 05-10-
16 63
5 QUALITY MANAGEMENT
For Quality management, please refer to the accompanied document on Quality
Management Plan
6 HUMAN RESOURCE MANAGEMENT
Name Organizatio
n
Role/Position
Jean Zahore AHA Sponsor
Dennis Lily AHA Manager
Albert Lee AHA Business Analyst
David
Thompson
AHA Developer
Eartha
Davis
AHA Developer
Eberardo
Hernandez
AHA Developer
Daniel
Mead
AHA Developer
Albie
Morkel
AHA Designer
Morne
Smith
AHA Tester
Andrew
Davies
AHA Tester
Marni
Wandel
AHA User
Neil Patel AHA Network Analyst
Kurt
Wilson
AHA Accountant
Page 8 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
7 COMMUNICATIONS MANAGEMENT
Item Provider Audience Form /
Media
Frequency
Project
Component
Documentation
Business
Analyst
Sponsor,
PM and
team
members
Document
on
Confluence
page with
authorized
access
After
every
release of
the
component
Project Status
Meeting
Project
Manager
Sponsors
and Users
Meeting
and
Presentation
Every Two
weeks
Blockers List Project
Manager
Dependent
Teams
Managers
Email Whenever
there is
any
blocker
Risk
Document
Business
Analyst
Sponsors Report Bi-Weekly
Change
Management
Report
Change
Authorizer
PM,
Stakeholders
and
Developers
Change
Request
Form
At every
release of
the
component
8 RISK MANAGEMENT
Risk Category Risk Risk Mitigation
Scope Working on the
project things that
are not in scope.
Ensure that all the requirements are
signed off initially and conveyed to all
the stakeholders.
Resources
and Team
Any crucial
resource decides
to leave midway.
Get the contract signed so that
resources don’t leave in the midway.
Resources
and Team
Lack of
Experience and
Skill.
Keep another option on the backup as
an replacement if the timeline is short.
Page 9 of 13
[Insert appropriate disclaimer(s)]

<Project Name>
9 PROCUREMENT MANAGEMENT
Materials will be procured from the designated vendors.
Page 10 of 13
[Insert appropriate disclaimer(s)]