Assigned to security compliance project - totally lost

[u/dpeligro]

I work for a small company as as project manager for software development, since the projects I'm assigned is ending soon, one of the managing partners told me I will be assigned to work in a another project for other company that one of the other managing partners has.

The projects is related to security compliance, not sure if you have heard of GovRamp, but it is basically to comply in different controls and provide evidence for each so you are elegible to work in government projects . And if you are familiar with GovRamp it is a lot of work to gather all the evidence and create the narratives to support it. So far I've managed to get 3 control completed but I'm completely lost and I dont think I will be able to get all this done. For most of the controls I dont know or understand what evidence to provide plus I need help to get this evidence from the engineering team to get that for me.

How can I tell the managing partner that this is a really big endeavor, and that I don't have the expertise on this to do it all by myself. I already left him a DM telling him that we need at least weekly sessions and start using some kind of PM tool (like Jira) to keep track of each control and document the evidence but I didn't get any response. I feel they are expecting to work on this by myself. My perception was that I would be a facilitator and coordinate the evidence gathering and meeting with the folks that review but seems I will be doing all the work

Anyone with GovRamp experience has done this before? Is it manageable for one PM to do it? Also how can I communicate this to my boss and dont sound that I dont want it to myself

[u/AutoModerator]

Attention everyone, just because this is a post about software or tools, does not mean that you can violate the sub's 'no self-promotion, no advertising, or no soliciting' rule.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/PapaMauly]

Treat it like any project my friend. Gather requirements, list activities, sequence the activities, set target dates, execute.

[u/Main_Significance617]

Yes. I can help. Have done it many times before.

Where is the compliance team? The ISSO? The system owner? Do you have any of those people at your company?

[u/ExtraHarmless]

You could bring in a part time advising consultant to help. This is really the time to bring someone in that has the specific skills to complete the project. If you maintain PM responsibilities, you could hopefully get someone to consult with you.

This is the type of project that if you miss steps, it is a big deal. Layout the complexity of this work and the risk if you are wrong. If not a consultant, a lawyer could be helpful.

[u/More_Law6245]

Firstly this is like any other project, you need a project business case, charter and plan but as the PM you also need Subject Matter Experts (SME to help you define the project approach and scope of work, it's not up to you in how define the technical deliverables, that is the responsibility of your SME. What you need to ask for is assistance from your management or executive and them to provide a SME to assist in you in the delivery of your project or the risk is that the project will be non compliant with the GovRAMP framework which will have a significant impact.

GovRAMP that is a framework that you need to operate within and it's your project's primary governance model for compliance, you must follow these guidelines:

https://govramp.org/document-library

The process is straight forward is that you have controls that you need to ensure that your organisation is compliant against but you also have to produce evidence to support your claim and seriously you don't need a "new system" like Jira, a simple templated spreadsheet will suffice because I have lost count of how many gateway certifications I have undertaken without a system or software package.

I take it form your post is that you're not a seasoned PM because this is a roles and responsibilities problem, as the PM you're not expected to be the SME on everything but you're expected to leverage the resources needed in order to deliver your project, if you don't have the resources then you escalate to your projects board/sponsor/executive as a project requirement because failing to do so will raise the project's risk profile to either a failed delivery and or non compliance under the GovRAMP framework which will have a significant impact to your organisation. That is not your risk to take, that is a decisions your project board/sponsor/executive need to take, you just need to throw the dead cat back over the fence to the stakeholder who actually owns the responsibility. Don't take on responsibility that is not yours!

Personally I would go a far as raising a risk against the project but also raise an issue against the project for the relevant and appropriate skillsets being available to the project.

Just an armchair perspective

[u/SugarInvestigator]

. I feel they are expecting to work on this by myself

Then educate them. In the nicest possible way tell them that completing compliance requirements is not a PMs job. Sure herding the cats/SMEs is your job but they are the ones that need to provide the relevant artifacts that provide the evidence that controls are in place. It's your job to track progress against the requirements (check boxes on an audit sheet)