ICT project and change management

The organization must develop, document, and implement an ICT project management procedure. It should take into account:

• it encompasses all stages of a project, from initiation to closure.
• Clearly define and document the roles and responsibilities of individuals involved in the implementation of ICT projects.
• Document the entire project management procedure to ensure consistency and accountability.
• Documented project management procedure is consistently executed across all ICT projects.
• Monitoring and reviewing the procedure's effectiveness and make adjustments as necessary to enhance project outcomes.

Inadequate change management is a common cause of incidents for digital services.

An organization shall document the change management process that must be followed whenever significant changes are made to developed digital services or other computing services that affect cyber security. The process includes requirements e.g. for the following:

• Defining and documenting the change
• Assessing the risks and defining the necessary control measures
• Other impact assessment of the change
• Testing and quality assurance
• Managed implementation of the change
• Updating a change log