Canada ITSG-33 - IT Security Risk Management A2-3.3.1: 3.3.1 Integrate ISSIP activities in the project plan

The project manager, with security practitioners and the authorizer, tailors the ISSIP to the project's goal and complexity and integrates its activities into the project plan rather than a separate plan, adding profile development if none exists. Security costs are estimated from the nature of the supported activities and category, the technical environment and security approaches, the assurance requirements, and the availability of profiles and threat reports; underfunding security leads to less secure systems and greater residual risk.