Information Security in Project Management Policy

Legislation checked · 26 June 2026 Not yet advocate-reviewed Execution steps not yet documented

Drafted by:: Lekha editorial team
Version:: v0.1
Last checked against current law:: 15 May 2026
Next scheduled review:: 15 November 2026

Statutory sources (4)

Digital Personal Data Protection Act, 2023Official statuteofficial source
Indian Contract Act, 1872Official statuteofficial source
Code of Civil Procedure, 1908Official statuteofficial source
Arbitration and Conciliation Act, 1996Official statuteofficial source

These badges show which checks this document has passed. They are not a judgment of whether it is legally valid or right for your situation — for a high-stakes matter, have an advocate review it →

After you download

Fill every [BRACKETED PLACEHOLDER] before signing — open the downloaded file and search for "[" to catch any you missed.
Check stamp duty for your state — many Indian documents are only enforceable on adequate stamp paper or e-stamp; the amount varies by state and document type.
Sign as required — check whether the document needs witnesses, and whether all parties must initial each page.
Check registration — some documents (e.g. certain leases, gift deeds) must be registered with the Sub-Registrar to be fully effective.
Keep signed originals safe and give every party a copy; note any filing, renewal, or compliance deadlines the document creates.

Generic checklist — document-specific stamping and filing steps for this template are being documented.

Generate a Information Security in Project Management Policy for India, free. Policy for embedding information security into every project, aligned with ISO/IEC 27001:2022 Annex A 5.8. Covers security-by-design from initiation, per-project risk assessment, security requirements and acceptance criteria at project gates, roles, and post-project review. Fill a guided online form and download as PDF or DOCX — no signup, no watermark, no cost.

✅ Free, no signup

Generate and download with no account and no payment.

⬇ DOCX & PDF

Download as PDF / DOCX.

🇮🇳 India-first

Follows Indian legal conventions and state rules.

Frequently asked questions

Is the Information Security in Project Management Policy free to use?

Yes. Lekha is completely free — generate and download your Information Security in Project Management Policy with no payment and no account required.

What format do I get?

You can download the Information Security in Project Management Policy as PDF, DOCX.

Is this Information Security in Project Management Policy valid in India?

The template follows India legal conventions. For high-stakes matters, have it reviewed by a qualified lawyer — Lekha lists verified advocates for free.

Organisation details

Organisation / company name *

Policy effective date *

Next review / expiry date

CISO / Security Officer name

Security review request email

PMO / Head of Delivery name

CEO / MD name (for management statement)

2 required fields left.

📋

Template verified May 2026 — checked against applicable central Acts and current state rules. Legal requirements can change; for property transactions above ₹5 lakh, employment disputes, or business agreements above ₹10 lakh, have a lawyer review it before signing →. Run Lekha Audit on any document you receive →

Attachments

Keep your letterhead, logo, or supporting documents handy while you fill the form. To analyse a document with AI, use Lekha Audit above.

Click or drag files here

Letterhead (PNG/JPG), Logo, PDFs — max 5 MB each

Live preview

0 of 2 essentials added — almost there · +5 optional

Aligned with ISO/IEC 27001:2022 Annex A 5.8

Effective Date: [Effective Date]
Review Date: [Review Date]
Control Reference: ISO/IEC 27001:2022 — A.5.8
Security Officer
PMO / Head of Delivery

Management Statement — , CEO/MD: Projects are how introduces change, and change is where new security risk is created. This Policy commits us to designing security into every project from its first day rather than bolting it on at the end. By assessing security risk for each project and confirming that security requirements are met before a project proceeds, we protect the confidentiality, integrity, and availability of the information our customers and partners entrust to us.

1. Purpose and Scope

This Information Security in Project Management Policy ("Policy") establishes how embeds information security into its projects, in support of ISO/IEC 27001:2022 Annex A Control 5.8. It applies to all projects undertaken by or on behalf of the Company, regardless of their type, size, duration, or delivery methodology, and to every employee, contractor, consultant, and third-party supplier who initiates, sponsors, manages, or delivers a project. The Policy applies irrespective of whether a project is delivered internally, jointly, or entirely by an external partner.

2. Policy Objective — Security by Design

The objective of this Policy is to ensure that information security is treated as an integral, non-optional part of project management from initiation to closure — the principle of "security by design and by default". Security is to be considered a project requirement in its own right, planned and resourced alongside scope, cost, quality, and schedule, and never introduced as an afterthought once a solution has already been built or deployed.

3. Embedding Security from Project Initiation

Information security shall be considered at the point every project is initiated, before significant design or build work begins. During a stage-gate model comprising Initiation, Planning, Execution, and Closure gates, the project mandate or business case must record: (a) the categories of information the project will create, process, store, or transmit; (b) an initial view of the information security and privacy risks the project may introduce or change; (c) any legal, regulatory, or contractual security obligations that apply; and (d) the individual accountable for information security within the project. Security considerations recorded at initiation shall be carried forward and refined throughout the project life cycle.

4. Per-Project Security Risk Assessment

A security risk assessment shall be performed for every in-scope project using a structured risk assessment aligned with ISO/IEC 27005. The assessment shall (a) identify threats and vulnerabilities relevant to the project's assets, technology, and data flows; (b) evaluate the likelihood and business impact of each identified risk; (c) determine appropriate risk treatment — mitigate, transfer, avoid, or accept — with named owners; and (d) be repeated or updated whenever the project's scope, architecture, data, or risk exposure changes materially. Residual risk that exceeds the Company's risk appetite must be escalated to the relevant risk owner and formally accepted before the project proceeds.

5. Security Requirements and Acceptance Criteria

Information security requirements shall be defined early and captured as explicit project requirements with measurable acceptance criteria. These shall address, as applicable: access control and least privilege; authentication and secrets management; encryption of data at rest and in transit; logging, monitoring, and audit; secure development and code review; hardening and secure configuration; resilience, backup, and recovery; and secure decommissioning of superseded systems and data. Acceptance criteria shall be testable, and a deliverable shall not be accepted as complete until its security acceptance criteria have been demonstrably met and evidenced.

6. Security Sign-off at Project Gates

Security shall be reviewed and formally signed off at each project gate or milestone. No project may pass a gate — including its go-live or production-release gate — until the CISO or a delegated security authority confirms that the security requirements for that stage have been met, that outstanding risks are within appetite, and that no high or critical security issue remains unaddressed. Security sign-off shall be recorded as part of the gate decision.

7. Roles and Responsibilities

Accountability for security in projects is assigned as follows: (a) the Project Sponsor is accountable for ensuring security is resourced and that residual risk is formally accepted; (b) the Project Manager, supported by the PMO led by , is responsible for planning, scheduling, and tracking security activities and evidence within the project; (c) the CISO / Information Security Officer () owns the security risk methodology, advises the project, and provides gate sign-off; (d) technical teams are responsible for implementing security requirements and producing evidence; and (e) suppliers delivering project work are contractually bound to comply with this Policy. Requests for project security review shall be directed to .

8. Third-Party and Supplier-Delivered Projects

Where any part of a project is delivered by an external supplier, the same security expectations apply as to internally delivered work. Supplier contracts and statements of work must include information security requirements, the right to review security evidence, obligations to report security incidents affecting the project, and clear ownership of security deliverables and residual risk. The Company shall not treat outsourcing of delivery as outsourcing of accountability for the project's security outcomes.

9. Change, Documentation, and Evidence

Security-relevant decisions, risk assessments, requirements, test results, and gate sign-offs shall be documented and retained as project records so that the security posture of each project is auditable after the fact. Changes introduced during a project that affect its security risk — such as new integrations, new data flows, or scope expansion — shall trigger reassessment under Clause 4 and, where required, re-approval under Clause 6. These records form part of the evidence base for ISMS internal audits and certification.

10. Privacy by Design

Where a project creates, processes, or changes how personal data is handled, privacy shall be designed in alongside security. A Data Protection Impact Assessment (DPIA) shall be completed for projects presenting a high risk to individuals, data minimisation and purpose limitation shall be built into the design, and lawful-basis, consent, and data-subject-rights requirements shall be treated as security requirements under Clause 5. This aligns with the DPDP Act, 2023 (India) and Article 25 of the GDPR (data protection by design and by default).

11. Post-Project Security Review

Within 30 days of project closure, a post-project security review shall be conducted to confirm that: (a) all agreed security requirements were delivered and evidenced; (b) any accepted or residual risks have been formally handed over to the appropriate operational or system owner for ongoing management; (c) temporary access, credentials, test data, and project environments created for the project have been revoked or securely decommissioned; and (d) lessons learned regarding security are captured and fed back into the Company's project and security practices. Open security actions must be assigned an owner and a target date; a project shall not be treated as fully closed while high or critical security actions remain outstanding.

12. Compliance, Review, and Enforcement

Compliance with this Policy is mandatory for all personnel and suppliers involved in projects. The CISO is responsible for monitoring compliance, and adherence shall be verified through project gate records and periodic ISMS internal audits. Non-compliance may result in a project being paused or halted at a gate and, for personnel, disciplinary action. This Policy shall be reviewed at least annually, and additionally following significant security incidents, material changes to the project delivery model, or changes in the legal or threat landscape. The next scheduled review date is [Review Date].

This Information Security in Project Management Policy has been approved by the management of and is effective from [Effective Date].

CEO / Managing Director

CISO / Information Security Officer

Connected legal intelligence

Everything on Lekha that relates to this document — the clauses inside it, what to do next, the law to learn, and the risks to watch. Educational, not legal advice.

Clauses inside, explained

Data protection (DPDP)Definition of Confidential Information Indemnity Governing law & jurisdiction

Full clause library →

Acts this document touches

Trace each Act to the clauses and other templates connected to it.

Digital Personal Data Protection Act, 2023 Indian Contract Act, 1872 Code of Civil Procedure, 1908 Arbitration and Conciliation Act, 1996

Common risks to watch

Data protection (DPDP). Allocates responsibilities for handling personal data under Indian law.
Definition of Confidential Information. Defines exactly what information the recipient must keep secret.
Indemnity. Allocates who bears the cost if a third party brings a claim.
Governing law & jurisdiction. Fixes which State's courts and which body of law decide any dispute under the document.

Learn the law

🛡️ DPDP Act 2023 & Indian Privacy LawEverything a startup, SME, or CA needs to know about India's new data law

📖 GuidesDPDP Act 2023: what every Indian website now needs →

Applicable compliance

Track these in your organisation's compliance register.

DPDP Act 2023 readiness

Published privacy policy

Open compliance register →

Related templates

Vendor DPA Information Security Policy HIPAA Security Rule Policy HIPAA Notice of Privacy Practices (NPP)HIPAA Business Associate Agreement (BAA)HIPAA Breach Notification Policy

🤖 Ask Vidhi about this documentor use the ✨ Ask AI bubble on any page.

Information Security in Project Management Policy

After you download

Frequently asked questions

Organisation details

📎Attachments

Connected legal intelligence

⚖️ Clauses inside, explained

🏛️ Acts this document touches

⚠️ Common risks to watch

📚 Learn the law

✅ Applicable compliance

📄 Related templates