As a primary step for analyzing the security requirement for an engagement, the Information Security And Compliance Lead must identify the contractual requirements for security. The Master Service Agreement, statement of work and its addendums must be thoroughly reviewed to gather these requirements. In addition, the Group and local /BU/Region Capgemini information security policies must also be reviewed to understand the required minimal level of the security aspects to be followed in the service engagement.

The scope of security requirements must be clearly understood in terms of:

• Physical and environmental security
• ODC (offshore development centre) requirement
• Isolated network requirements (if any)
• Background checks (BGC) for human resources
• Applications and infrastructure under scope
• Access control requirements
• Data security requirement (if any)
• Mobile security requirement (if any).

In addition to these requirements, the Information Security And Compliance Lead must also identify compliance requirements.

This would typically include:

• Security standards to which compliance is required
• Compliance trainings requirements
• Audit or assessment requirements.