eu-LISA_EPMO_PM_Methodology_6.0.3

Eu-LISA Project Management Methodology Enterprise Project Management Office (EPMO) Handling instructions for the marking LIMITED BASIC • Distribution on a need-to-know basis. • Not to be released outside of the information stakeholders. • Not for publication. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e |1

eu-LISA PM Methodology Table of Contents 1. Purpose ........................................................................................................................................... 5 2. Methodology Ownership ................................................................................................................. 5 3. Scope .............................................................................................................................................. 5 4. Audience ......................................................................................................................................... 5 5. Organizational Project Management (OPM) at eu-LISA...................................................................6 6. Overview of the Project Management Lifecycle...............................................................................9 7. Project Classification within eu-LISA.............................................................................................. 10 8. Scalability and Tailoring the Methodology..................................................................................... 11 9. Project Definition .......................................................................................................................... 12 10. Project Coding Convention ............................................................................................................ 13 11. Project Governance ....................................................................................................................... 14 12. Roles and Responsibilities.............................................................................................................. 15 13. Communication ............................................................................................................................. 18 14. Before starting your project ........................................................................................................... 20 15. Description of the Project Management Process ........................................................................... 21 16. Project Management Process Diagram.......................................................................................... 22 17. Introduction to the sub-processes.................................................................................................. 23 18. Starting Up a Project (SU).............................................................................................................. 24 SU1 – Qualify Business Case .......................................................................................................... 25 SU2 –Approve Business Case......................................................................................................... 27 SU3 – Appoint Key Roles................................................................................................................29 SU4 – Collect Lessons Learned ...................................................................................................... 31 SU5 – Calibrate Business Case ....................................................................................................... 33 SU6 – Appoint Project Management Team.................................................................................... 35 SU7 – Create Project Brief.............................................................................................................. 37 SU8 – Plan the Initiation Stage ...................................................................................................... 39 19. Initiating a Project (IP) ................................................................................................................... 41 IP1 – Develop Management Strategies .......................................................................................... 42 IP2 – Create Draft SSRS & PIA ....................................................................................................... 45 IP3 - Develop Project Management Plan ........................................................................................48 IP4 – Refine Business Case............................................................................................................. 51 IP5 - Assemble PID......................................................................................................................... 53 20. Directing a Project (DP) ................................................................................................................. 55 DP1 – Authorise Initiation .............................................................................................................. 56 DP2 – Authorise Project................................................................................................................. 58 DP3 – Authorise Stage or Exception Plan .......................................................................................60 DP4 – Give Ad-hoc Direction..........................................................................................................62 DP5 – Authorize Project Closure ....................................................................................................64 21. Controlling a Stage (CS).................................................................................................................66 CS1 – Authorise Work Packages..................................................................................................... 67 Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e |2 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA CS2 – Review Work Package Status ............................................................................................... 70 CS3 – Receive Completed Work Packages ..................................................................................... 72 CS4 – Review the Stage Status...................................................................................................... 74 CS5 – Take Corrective Actions ....................................................................................................... 76 CS6 – Capture and Examine Issues and Risks ................................................................................. 78 CS7 – Escalate Issues and Risks ...................................................................................................... 80 CS8 – Report Project Status........................................................................................................... 82 22. Managing Stage Boundaries (SB)...................................................................................................84 SB1 – Plan the Next Stage ............................................................................................................. 85 SB2 – Update the Project Management Plan ................................................................................. 87 SB3 – Review SSRS and PIA ..........................................................................................................89 SB4 – Security and DP Assessment................................................................................................92 SB5 – Update the Business Case....................................................................................................94 SB6 – Report Stage End ................................................................................................................96 SB7 – Produce an Exception Plan ..................................................................................................98 23. Managing Product Delivery (MP) ................................................................................................. 100 MP1 – Accept a Work Package..................................................................................................... 101 MP2 – Execute a Work Package ................................................................................................... 103 MP3 – Deliver a Work Package..................................................................................................... 106 24. Closing a Project (CP) .................................................................................................................. 108 CP1 – Prepare Planned Closure .................................................................................................... 109 CP2 – Hand over Product ..............................................................................................................111 CP3 – Evaluate the Project ............................................................................................................113 CP4 – Recommend Project Closure...............................................................................................117 CP5 – Prepare Premature Closure ................................................................................................ 119 25. ANNEX A..................................................................................................................................... 121 26. ANNEX B – Project Completion Criteria ....................................................................................... 124 27. ANNEX C – Project Management Artefacts and RASCI Matrix ......................................................131 Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e |3

eu-LISA PM Methodology DOCUMENT CONTROL Document Version v 6.0.3 – PUBLISHED and Date 23/04/2020 Authors Rosaria GIOVANNELLI, Application Management & Maintenance Unit Purpose Sebastian CAZACU, EPMO Consultant This document describes the Project Management Methodology implemented at eu-LISA. Its purpose is to describe the key activities, processes and techniques for managing successful projects. Audience eu-LISA Internal Sensitivity LIMITED BASIC Revision History Revision Date By Summary of Changes 24/09/2014 Rosaria GIOVANNELLI Created version 6.0 29/09/2017 Sebastian CAZACU Version 6.0.1 • Change the name from PM Manual to PM Methodology • Update the location of the PM Methodology (EPMO Intranet) • Add the difference between methodology, process and lifecycle (section 5) • Create the PM Lexicon as a separate document • Defining the Organizational Project Management (OPM) framework, prescribed by the EPMO Charter • Introducing the Project Management Lifecycle (conceptual – section 6) • Defines the Project Governance Framework, to reflect the new EPMO Charter, EPMO Governance Framework, as well as ED 125/2016 and 126/2016 (PSC and MPB, section 9 and updates to section 10) • Adding the description of how the conceptual Project Management Lifecycle is applied throughout the Project Lifecycle, resulting in the Project Management Process Diagram (beginning of section 13) • Methodology Roadmap added as Annex C 17/11/2017 Sebastian CAZACU Version 6.0.2 27/02/2018 Sebastian CAZACU • Restructure the entire PM process to ensure alignment to: 21/04/2020 Sebastian CAZACU o Eu-LISA Project Governance o PRINCE2 methodology • Added Project Classification Method and Tool • Added the process diagram for each process • Added scalability through customized templates • Add the Project Definition section (9) • Add the project Coding Convention section (10) • RACI matrix added in Annexe C Approvals This document requires the following approvals Name Signature Title Date of Issue Version Krum Garkov Executive Director of eu-LISA 24/09/2014 Distribution Title Date of Issue Version This document has been distributed to Name Eu-LISA Management Executives, HoD, HoU 19/11/2014 v 6.0.1 Eu-LISA Staff 23/04/2020 v 6.0.3 Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e |4 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 1. Purpose Project Management Methodology (PMM) provides Project Managers and project teams with a prescriptive methodology for initiating, planning, executing, monitoring, controlling, and closing projects, which is aiming to: • Align organizational strategy with the project execution environment. • Ensure all undertaken projects are completed on time, within the budget and within the agreed upon scope. • Facilitate the best use of organizational resources across multiple projects. • Enhance the cross-functional collaboration among organizational structures, while developing a collaborative approach on managing projects. • Provide top management with qualitative and relevant information for the decision-making process. • Enable the Agency to realise the benefits for which the investment in projects has been made. • Provide the foundation for developing an active Project Management community within eu-LISA The Project Management Methodology provides a detailed description of WHAT needs to be done, WHEN it needs to be done, and by WHOM. The accompanying Project Management Practice Guide (soon to be released) is providing details on HOW to perform all project management activities prescribed by the Project Management Methodology. 2. Methodology Ownership The owner of the Project Management Methodology is the eu-LISA Enterprise Project Management Office (EPMO). 3. Scope This document covers the following elements of the Project Management Methodology: • Project Management Lifecycle: the sequence of management activities that need to be carried out for successfully managing projects • Description of processes, and process steps within each process • Description of all roles and their associated responsibilities in managing projects • Interactions with other organizational processes • Definition of a project, within the specific organizational context of the Agency • Templates 4. Audience This Project Management Process Methodology is primarily intended as guidance for the following roles within eu-LISA: • Project Managers • Other roles temporarily nominated for managing projects • Senior managers who have project governance responsibilities • Project team members across the Agency. • The Project Management Methodology will be also used by vendor project managers to comply with Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e |5

eu-LISA PM Methodology the eu-LISA’s requirements for managing outsourced projects and sub-projects 5. Organizational Project Management (OPM) at eu-LISA What is a project? The PRINCE2 methodology proposes two definitions of the project: 1) “A management environment that is created for the purpose of delivering one or more business products according to a specified Business Case” 2) “A temporary organisation that is needed to produce a unique and predefined outcome or result at a specified time using predetermined resources” The notion of outcome can be understood very broadly and it could mean for example: a new software, pieces of hardware, a methodology, etc. What is the Organizational Project Management Governance? According to the EPMO Governance Framework document, the Organizational Project Management (OPM) Governance is the framework, functions and processes that guide the application of Project, Programme and Portfolio Management activities at the organizational level, with the goal of aligning these practices with the Agency’s strategy (EPMO Governance Framework, section 5). The OPM Governance describes how the Project Management discipline shall be applied across all projects within eu-LISA, and is composed of a number of elements: • Governance Bodies • Roles and Responsibilities • Executive Decisions • EPMO Charter • EPMO Service Catalogue • PM Lexicon • Project Management Policy • Project Management Methodology (this document) • Project Management practice guides and bodies of knowledge (to be developed further as separate documents) • Enterprise Project Management (EPM) system • Competence Development Framework The architecture of the OPM Governance and its component elements are depicted in the following diagram: Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e |6 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA What is the Project Management Policy? The purpose of the policy is to establish and communicate the organizational expectations in regards to processes and methodologies used to manage projects across eu-LISA. The Project Management Policy is used as foundation for developing and maintaining the Project Management Methodology (this document). What is the Project Management Methodology? The Project Management Methodology is the complete system of processes, procedures, templates, bodies of knowledge and practice guides that are used by the Project Managers to guide the practical application of Project Management discipline to their projects. The foundation of the Project Management Methodology is provided by the following elements: • The EPMO Governance Framework • The Project Management Policy • The Project Management Lifecycle • Practices guides, procedures and bodies of knowledge The Project Management Methodology contains the following elements: • Interconnection with foundational elements: EPMO Governance Framework and Project Management Policy • Description of the conceptual Project Management Lifecycle, which is used for creating the specific Project Management Methodology • Description of the Project Management Process Diagram (WHAT, WHO, WHEN) Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e |7

eu-LISA PM Methodology • References to accompanying practice guides, procedures and bodies of knowledge, that are used in applying the Project Management Methodology (HOW) • Project classification method • Lessons Learned • Project Management Lexicon Without such a structural approach, there is a risk that those who are involved in the management of projects may have differing views about how things will be organised and completed. Furthermore, there will be confusion around roles and responsibilities, authority and accountability. Ultimately, the project will not only be delayed, but will cost more than budgeted and not fit for its intended purpose. The implementation of a Project Management Lifecycle facilitates the implementation of strategic changes in a structured and consistent manner, provides standardised management information and contributes to the mitigation of project risks. It also provides assurance to the Agency’s Management that investments made in projects are meeting their business objectives the most efficient manner. What is the Project Management Lifecycle? Project Management is the application of knowledge, skills, tools, and techniques to project activities to meet the project requirements (Project Management Body of Knowledge, 5th Edition - PMI). The Project Management Lifecycle is the sequence of management activities to be performed for successfully managing a project from its inception to closure. The Project Management Lifecycle is the backbone of the Project Management Methodology, and is described further within this document. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e |8 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 6. Overview of the Project Management Lifecycle The eu-LISA Project Management Lifecycle (PML) results from applying the conceptual PDCA (Plan-Do-Check- Act) cycle to the specifics of projects, which have a definite beginning and a definite end. Project Management Lifecycle is standard for all projects and consists of the following cycle of management processes: Initiating, Planning, Executing, Monitoring & Controlling, and Closing. They are collectively defining all the management activities required to successfully complete the project. These processes are applied iteratively throughout the project. Project Management Lifecycle is applied iteratively and many of its processes are repeated during the project, such as for instance the initial planning, followed by re-planning when change requests are approved (Exception Report, followed by the Exception Plan). Another example might be when Planning process is performed for the first phase of the Project Lifecycle, then Planning of the second phase, etc. Stage Objective Decision Responsible Outcome INTAKE Point Assess the viability of a Project Program Authorization INITIATING proposed project and carry out Selection Steering for INITIATING intake activities Committee Stage PLANNING Project (PSC) Plan the early stages of the Authorization Program Authorization project, and obtain approval of Steering for PLANNING the Project Initiation (PID) by Ready for Committee Stage the Program Board Executing (PSC) Develop the detailed plans for (RfE) Program Authorization for completing the project. Steering EXECUTING Planning stage re-occurs Committee Stage Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e |9

eu-LISA PM Methodology EXECUTING whenever a phase in the Project Acceptance (PSC) Accepted Project Lifecycle is planned, or when Gate Deliverables MONITORING & re-planning is necessary (such Project Team CONTROLLING as the Exception Plan) Continuously Authorization throughout Multi-Project for CLOSING Perform the execution of the the project Board (MPB) Stage project work to develop the Program desired solution or outputs Steering Authorization Committee for Final Closure Continuously monitor the (PSC) of the project project performance against Program the approved baseline, and Steering Confirm initiate corrective actions Committee transition to whenever variances occur. (PSC) operations of the Transition project’s CLOSING Close down the project and Closure Gate Team deliverables review its effectiveness in meeting its objectives TRANSITIONING Ensure the results of the project Out of the are properly transitioned to the project operational environment, so boundaries the expected benefits can be realized at the program or organizational level. 7. Project Classification within eu-LISA Project classification is done by assessing a number of project parameters which are relevant in regards to the level of control needed to ensure the foreseen benefits can be delivered as planned. The classification method and tool are provided in the accompanying ProjectsClassificationTool.xlsx. Why classify? The amount of documentation and required project management activities will scale adequately to the size of the project. Who will classify the project? eu-LISA EPMO will be responsible of the projects’ classification, by using the above mentioned method and tool. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 10 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 8. Scalability and Tailoring the Methodology The Project Management Process described in this manual is based on PRINCE2 methodology but it has been tailored to fit the specific needs of eu-LISA. PRINCE2 is a scalable method that can be applied to projects of varying sizes and types. The seven principles of PRINCE2 are universal, they are self-validating due to the large quantity of projects that have used the method, and they provide a confident approach to directing a project. Adapting the PRINCE2 project management approach to the situation ensures alignment of processes, tools and techniques, to best support and manage the project, while avoiding a forced compliance to the original process. Tailoring the methodology doesn’t mean to remove or skip processes and/or process steps, but to adjust the level of sophistication and complexity in performing the activities prescribed in the Project Management Methodology, along with adjusting the related templates. Depending on the project classification, some of the management deliverables of the Project Management Methodology may be scaled down. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 11

eu-LISA PM Methodology 9. Project Definition The standard definition of a project needs to be applied within the particular context of eu-LISA, in order to ensure that PM Methodology is only applied to activities that satisfy all criteria to be considered projects, and the application of Project Management doesn’t introduce an unnecessary overhead. • For the purpose of applying the eu-LISA PM Methodology, an activity within the Agency must satisfy both of the following two qualitative criteria: For being considered a project, an activity must have a planned start-date and a planned end-date. This doesn’t refer to the actual duration of the activity (short, medium, or long), nor with the fact that both start-date and end-date can be changed during the iterative planning cycle. This criterion is introduced because TEMPORARY the Project Management process and techniques are only applicable to activities that have a definite beginning and a definite end. UNIQUENESS The temporary criterion doesn’t apply to the duration of the product resulting from the respective project, as many projects are producing long lasting results. For an activity to be considered a project and managed through the use of PM Methodology, the result of it must be unique in some way. A project might include some elements of repetitive work, but it must have some unique characteristics. Uniqueness of a project can come from various aspects, such as the project result, different circumstances in which the project is undertaken, different resources, etc. • For the purpose of applying the eu-LISA PM Methodology, an activity within the Agency must satisfy at least one of the following two quantitative criteria: BUDGET A minimum estimated budget of 300.000€ is required for an activity to be And considered a project and managed with the PM Methodology. An activity which is budgeted for less than 300.000€ is too small to justify the effort of applying DURATION rigorous Project Management techniques. A minimum estimated duration of 3 months is required for an activity to be EFFORT considered a project and managed with the PM Methodology. A shorter duration (INTERNAL AND wouldn’t allow for a proper application of the entire Project Management EXTERNAL FTE) process and would introduce unnecessary overhead. 3 FTE minimum, for the duration of the project The logic operation to apply all the criteria (quantitative and qualitative) is depicted below: (Temporary AND Uniqueness) AND ((Budget AND Duration) OR Effort) Project qualification (satisfaction of these criteria) should be checked during the eu-LISA’s Corporate Planning phase, based on the estimated values available at the time. However, as the planning effort is an iterative process, more information could become available, which might require reassessment of the above mentioned criteria, And thus re-qualifying the activity as either project or Business As Usual activity. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 12 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 10. Project Coding Convention All activities classified as project shall follow the coding convention described below, apart from their narrative title: YYYY A/M System Area Type of nnn Year when the Annual or Multi- SIS, VIS, EDC Project Sequential number project is planned annual (Eurodac), EES, of the project for to start (from the ETS (ETIAS), ECS New development the system area, in Planning (ECRIS TCN), ECX (DEV), Evolution the year Document) (e-CODEX), CSI (EVO), Horizontal (Common Shared (HOR), PLT (Pilot), Infrastructure), POC (Proof of COR (Corporate Concept), TST Services), CIN (Testing activities), (Communication STD (Study), 1.2.1 Infrastructure), 121 (Ad-hoc OTH (Others) support ex article 12.1 new ER), 1.2.2 122 (Additional services ex article 12.2 new ER) Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 13

eu-LISA PM Methodology 11. Project Governance The project governance layers are fully defined and described within the “EPMO Governance Framework” and its accompanying documents. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 14 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 12. Roles and Responsibilities There are different key roles in the Project Governance and they are listed in the table below: Role General Responsibilities Program Steering • Oversees progress of approved projects and programs Committee (PSC) • Assess risks and issues raised by the Multi-Project Board and approve Multi Project Board the corresponding risk response plans (MPB) • Decide on re-prioritisation of activities and re-distribution of resources EPMO as result of issues and conflicts raised by the Multi-Project Board (MPB) • Assess change requests with impact on schedule, budget, resources and quality, and assess their impact on the Annual Work Programme of • Review and approve new Business Cases and assess their impact on the approved Annual Work Programme • Approve amendments to original Business Cases • Approve Project Initiation Documents (PID) and triggers the formal start of projects comprised in the programme and foreseen in the approved Annual Work Programme • Review Exception Reports and their corresponding Exception Plans escalated by the Multi-Project Board (MPB) and advise the Executive Director on their approval/ rejection • Establish the need and formulate the requirements for the contracts amendments to the contracts relevant for the implementation of the program • Propose amendments to the Annual Work Programme of the Agency • Is the unique body that can approve project tolerances’ deviations • Decide whether the project is authorised to pass the Process Management Process stage-gates • Ensures proper operational steering of projects • Review progress of approved projects against the approved plans • Identification and resolution of planning conflicts occurred due to dependencies between projects • Assesses risks and issues raised by Project Managers, and agree on their mitigation plans. If identified risks and issues have impact at the program level, they shall be escalated along with the corresponding mitigation plans to the Program Steering Committee • Approve change requests impacting the approved tolerances, re- prioritize activities and re-allocate resources • Resolve planning conflicts occurred due to dependencies between projects • Identify and submit to PSC change requests with impact on schedule, budget, human resources and quality • Identify and propose to the PSC amendments to existing contracts or establishment of new contracts, if required for successful completion of projects • EPMO has a strong supply side role in ensuring that the project is delivered successfully • Provides information to the Program Steering Committee and Multi Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 15

eu-LISA PM Methodology Project Executive Project Board on business cases, risks and project performance (member of Program • It also has an enforcing and regulatory role in ensuring projects and Board) programs conform to agreed standards and best practices. Senior User (member of Program Board) • Is ultimately responsible for the project, supported by the Senior User and Senior Supplier. Senior Supplier (member of Program • Ensures that the project is focused throughout its life cycle on Board) achieving its objectives and delivering a product that will achieve the Project Manager projected benefits. Project Assurance • Ensures that the project gives value for money, ensuring a cost- conscious approach to the project, balancing the demands of business, Security Officer user and supplier. Data Protection Officer Responsible: • for the specifications of the needs of all those who will use the final product(s), • for user liaison with the project team and • for monitoring that the solution will meet those needs within the constraints of the Business Case in terms of quality, functionality and ease of use. The Senior User ensures the provision of necessary user resources (e.g. for user acceptance testing, validation of specification, etc..) are made available. • Represents the interests of those designing, developing, facilitating, procuring, implementing and possibly operating and maintaining the project products. • Is accountable for the quality of products delivered by the supplier(s). • Responsible for the execution of project tasks on a day-to-day basis on behalf of the Program Board within the constraints given by the Board. • As with PRINCE2, the Project Manager’s prime responsibility is to ensure that the project produces the required products in accordance with the time, cost, quality, scope, risk and benefit performance goals. Assurance covers all interests of a project, including business, user and supplier. It has to be independent of the Project Manager therefore the Program Board cannot delegate any of its assurance responsibilities to the Project Manager. Project Assurance responsibilities can be shared amongst the Program Board or an internal or external member added to the Program Board to carry out some, or all, of the assurance role. • Responsible for the coordination and supervision of security measures at Agency level, including the security of the centrally organised systems. • In the PM Process, he has the responsibility to produce the SSRA and SSRS documents. The Security Officer will perform the project’s security tests as per scope and schedule approved by the Program Board in the PID. Responsible for: • specifying the desired outcome of the project from the Data Protection perspective • the assessment of the data protection compliance specifications • evaluating the impact of potential changes from privacy compliance perspective • resolving privacy requirements towards user’s requirements and Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 16 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA Application Managers priority conflicts • constantly monitoring risks to the users privacy Transversal Teams • advising on all privacy aspects concerning the project The Data Protection Officer ensures that quality control procedures with the Project Team legal compliance in terms of Data Protection are used correctly and that Project Support products meet the data protection requirements. The Data Protection Officer is responsible of producing the PIA and the Privacy Compliance Report documents. He is also responsible to perform the specific project’s DP tests/assessments as per scope and schedule approved by the Program Board in the PID. • Overview and supervision of the Programmes for the respective applications for which they are responsible • Resource team dedicated to performing specific project activities (e.g. Test Team, Security Team, DPO) • Resource team dedicated to performing project activities The provision of any Project Support on a formal basis is optional. Project Support performs tasks need to be done by the Project Manager and this will be driven by the needs of the individual project and Project Manager. Examples of activities which could be performed by a Project Support function include: • Tracking and updating of project or stage plans • Collating risk and issue information and updating logs • Provision of financial or budgetary support • Owning and maintaining the library of documentation produced by the project Project roles can be tailored to suit the needs of the project. Tailoring may include combining roles or dividing a role between two or more people. Responsibilities may be moved from one role to another, but should never be dropped. It is important to note that the roles of Senior Supplier and Senior User should not be combined, to avoid potential conflicts of interest. Further information on project management team roles and responsibilities can also be found in the Organisation section of PRINCE2. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 17

eu-LISA PM Methodology 13. Communication EPMO reporting activities EPMO will regularly communicate on projects’ status through: • Project Intake List • Aggregated view of the Projects’ Dashboard • Quarterly Reports EPMO Internal Meeting Purpose: To ensure an efficient planning and monitoring of the overall EPMO activity. Frequency: weekly Agenda (example): 1. Progress on the Methodology and Policies 2. Ad-hoc matters Participants: EPMO members Multi-Project Board Meeting (according to the ED 126/2016 and 179/2016) Purpose: The Program Board meeting will bring together key stakeholders from across the Agency to ensure the project runs effectively, in particular by: • Ensures proper operational steering of projects • Review progress of approved projects against the approved plans • Identification and resolution of planning conflicts occurred due to dependencies between projects • Assesses risks and issues raised by Project Managers, and agree on their mitigation plans. If identified risks and issues have impact at the program level, they shall be escalated along with the corresponding mitigation plans to the Program Steering Committee • Approve change requests impacting the approved tolerances, re-prioritize activities and re-allocate resources • Identify and submit to PSC change requests with impact on schedule, budget, human resources and quality • Identify and propose to the PSC amendments to existing contracts or establishment of new contracts, if required for successful completion of projects Frequency: • Twice per month Agenda: • Progress report per project • Previous meeting actions review • Periodic review of the projects’ KPIs • Schedule and resources conflicts to be solved within the agreed tolerances Participants: Chairperson: Head of EPMO Permanent members: Application Managers, Project Managers, Test Manager, Release Manager, EPMO Representative Non-permanent members: Strategy Planning Officer, Budget Officer Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 18 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA Program Steering Committee Meeting (according to the ED 125/2016 and 178/2016) Purpose: The PSC meeting will bring together key stakeholders from across the Agency to ensure the project runs effectively, in particular by: • Oversees progress of approved projects and programs • Assess risks and issues raised by the Multi-Project Board and approve the corresponding risk response plans • Decide on re-prioritisation of activities and re-distribution of resources as result of issues and conflicts raised by the Multi-Project Board (MPB) • Assess change requests with impact on schedule, budget, resources and quality, and assess their impact on the Annual Work Programme • Review and approve new Business Cases and assess their impact on the approved Annual Work Programme • Approve amendments to original Business Cases • Approve Project Initiation Documents (PID) and triggers the formal start of projects comprised in the programme and foreseen in the approved Annual Work Programme • Review Exception Reports and their corresponding Exception Plans escalated by the Multi-Project Board (MPB) and advise the Executive Director on their approval/ rejection • Establish the need and formulate the requirements for the contracts amendments to the contracts relevant for the implementation of the program • Propose amendments to the Annual Work Programme of the Agency • Is the unique body that can approve project tolerances’ deviations • Decide whether the project is authorised to pass the Process Management Methodology stage-gates Frequency: • At least once per month • Agenda: • Previous meeting actions review • Review of Program Dashboard and KPIs • Review of PIDs, business cases, impact assessments, exception reports, change requests • Contractual matters Participants: Chairperson: Executive Director Permanent members: Head of Resources and Administration, Head of Operations, Head of Application Management and Maintenance, Head of Operations and Infrastructure, Security Officer, Head of Procurement Non-permanent members: Application Managers, Strategy Planning Officer, Budget Officer EPMO Community Meeting Purpose: The purpose of this meeting is to provide guidance to PMs and to present new EPMO tools and best practices, derived from Lessons Learned and regular Quality Assessment results from projects. Frequency: monthly Agenda: 1. New EPMO Tools presentation 2. New Best Practices review Participants: EPMO members and PMs Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 19

eu-LISA PM Methodology 14. Before starting your project Before starting to manage your project, please contact EPMO ([email protected]), your will receive guidance and your project will be added: • in actiTIME • in the Dashboard Then, as Project Manager you will be invited to the Multi-Project Board Meeting and added to the PM distribution list. The PM methodology can be found on the EPMO Intranet\\Project Management Tools and templates can be found in: EPMO Intranet\\Project Management\\PM Templates For any specific question on your project do not hesitate to contact EPMO. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 20 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 15. Description of the Project Management Process The Project Management Lifecycle is made up of distinct processes. Each of these processes has a distinct purpose. Project Management Lifecycle should not be confused with System Development Lifecycle (SDLC), which is made of all phases that a project passes through from inception to closure. The SDLC depends on a number of factors such as the nature of the project, organizational context, industry, technological choices and constraints. The Project Management Lifecycle describes what needs to be done for managing the project, whereas the SDLC describes activities required to produce the project deliverables. The following diagram depicts the relationship between the Project Management Lifecycle and the SDLC: The exact application of the Project Management Lifecycle to the SDLC will result in the set of specific processes which are depicted in the following diagram: Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 21

eu-LISA PM Methodology 16. Project Management Process Di Date: 17/04/2020 Version: v 6.0.3

iagram eu-LISA LIMITED BASIC P a g e | 22

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 17. Introduction to the sub-processes The eu-LISA Project Management Methodologies is composed of 7 processes, with components process steps within each of them. Each process step is described in the following manner: • Purpose - a short description of the step’s purpose • Responsibilities – the actors who are involved in the process • Inputs - information, documents or other outputs from a previous process which are needed in order for the process step to be completed • Description - a brief description of the process step • Outputs - the outputs produced by the process step • Benefits - the benefits of performing the process step • Activity Summary – brief summary of major activities within the process step • Completion Criteria - criteria which must be met to ensure that the process step has been successfully completed • Scalability and Templates - the outputs and approach to the process step may vary according to the size, complexity and risk level of the project. This section shows details of how the process step may be scaled, along with the associated templates. • Best Practices - hints, tips and additional guidance to support the process step where appropriate • References - Cross references to any other material or methodologies as appropriate Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 23

eu-LISA PM Methodology 18. Starting Up a Project (SU) The Starting Up a project (SU) is the final step of the broader project selection process, which is linked to the Agency’s strategic planning cycle (year N-2 to year N). The strategic planning cycle is mainly addressing the project evaluation and selection, a process that is taking place at the Portfolio Management process (Portfolio Definition sub-process). The Starting Up a Project is using the outputs of the project selection to perform the next process in the Portfolio Management, which is Portfolio Authorization. The exact link between the above mentioned processes can be observed in the process diagram bellow. The purpose of the SU process is to ensure that only viable, desirable and achievable project proposals are submitted for initiation to the Management, thus the effort required to initiate a project is well spent, in alignment with the Agency’s strategy. This is achieved by: • Confirming that Business Case is still relevant at the time of the actual authorization of the project (year N), or the needed adjustment/recalibration is done properly before initiating the project • New, ad-hoc project proposals are evaluated by using the same approach as in the N-2 planning cycle, but on a faster track • Key project roles are appointed for preparing a comprehensive Project Initiation Documentation The process diagram bellow depicts major process steps within Starting Up a Project, along with main information flows. The remaining details of individual interactions between process steps are further described in the respective section describing each step. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 24 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU1 – Qualify Business Case Purpose The purpose of this process step is to trigger the Starting up a Project process in a formal manner, so all proposed projects are aligned with the Agency’s strategy. INPUTS DESCRIPTION OUTPUTS • Business Case • Approved project proposals • Qualified Business Case are extracted from AWP and • Notification to PSC for included in the Intake List by the EPMO reviewing the Business Case • For ad-hoc project proposals, a • Intake List proper Business Case is prepared and submitted to PSC for approval Preconditions Case A, Legal Mandate: Business Case is pre-approved and included in the Annual Work Programme for the year N (current year) OR Case B, Ad-hoc Business Trigger: Business Case is prepared by the project requestor and submitted to MPB Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Business Case Qualify ARP Intake List Create P Notification to PSC for reviewing the Business Case Send AP Benefits The PSC has proper information to decide on whether to approve or reject the project. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 25

eu-LISA PM Methodology Activity Summary • Case A, Legal Mandate: Beginning of each year, MPB will review the list of projects included in the AWP. • Case B, Ad-hoc Business Trigger: the project initiator submits the Business Case of the proposed project to the MPB • EPMO provides technical support for checking all submitted Business Cases for completeness, against the approved Business Case template. In case of non-compliance issues, EPMO provides recommendations and guidance to Business Case owners for closing the gaps. • MPB submits the qualified Business Cases to the Program Steering Committee (PSC) Completion Criteria A completeness review of the Business Case has been completed ¨ Notification to PSC has been sent ¨ Scalability and Templates Medium Projects Large Projects Business Case Business Case Small Projects Business Case Best Practices TBD References PRINCE2 Methodology: Prepare the Business Case Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 26 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU2 –Approve Business Case Purpose The purpose of this process step is to ensure that only initiatives aligned with the Agency’s strategy are formally started-up, through the prescribed governance mechanism. During this process step, PSC decides on approving or rejecting the proposed Business Case. INPUTS DESCRIPTION OUTPUTS • Business Case For new project proposals, PSC • Approved Business Case shall perform a full evaluation • Notification to add the project and decide whether to approve or reject the proposal. to the Intake list Preconditions Notification for reviewing Business Case has been received by the PSC and included in the next meeting agenda Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Business Case Approve A RP Notification to add project to Intake List Send P Benefits Through this process, PSC ensures all the proposed projects are aligned with the Agency’s strategy. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 27

eu-LISA PM Methodology Activity Summary • PSC reviews the submitted Business Cases and makes a decision on whether to approve or reject the proposals. • In case of approval, PSC notifies EPMO for adding the approved projects in the Intake list. Completion Criteria A full evaluation of the Business Case has been completed ¨ Business Case has been formally approved ¨ Notification to update the Intake List has been sent to EPMO ¨ Scalability and Templates Medium Projects Large Projects Business Case Business Case Small Projects Business Case Best Practices TBD References PRINCE2 Methodology: Project Mandate, Prepare the Business Case Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 28 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU3 – Appoint Key Roles Purpose The purpose of this step is to ensure the key roles are appointed, so the activities within Starting up a project can be carried out properly. INPUTS DESCRIPTION OUTPUTS • Approved Business Case • Identify and appoint the • Appointed Project Executive Project Executive from the • Appointed Project Manager project's stakeholders • Recommendations and • Identify and appoint the guidance Project Manager for the project • Notification to EPMO • Confirm the selected persons' availability, their acceptance of these roles, and their commitment to carry them out Preconditions: Business Case of the project has been approved by the PSC Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Appointed Project Executive Confirm P Appointed Project Manager Send P Benefits Responsibilities for the key roles are set, so the project can be properly prepared for Initiation. Activity Summary • Project Executive and Project Manager are identified based on the project’s specifics, organizational constraints, availability and required skills • Nominated Project Executive and Project Manager confirm their availability and commitment to perform the duties of their respective roles • PSC appoints the Project Executive and Project Manager • PSC provides recommendation and guidance for further steps • PSC notifies the EPMO on the appointed key roles Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 29

eu-LISA PM Methodology Completion Criteria Project Executive and the Project Manager have been appointed ¨ Project Executive and Project Manager confirm their ability and commitment ¨ Notification to EPMO has been sent ¨ Scalability and Templates Medium Projects Large Projects Business Case Business Case Small Projects Business Case Best Practices TBD References • PRINCE2 Methodology: Starting Up a Project, Appoint the Executive and the Project Manager activity • EPMO Governance framework • ED 125/2016 Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 30 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU4 – Collect Lessons Learned Purpose The purpose of this step is to ensure the project is benefiting from past experience. INPUTS DESCRIPTION OUTPUTS • Lessons Learned Reports This process captures lessons, • Lessons Log both positive and negative, from previous projects. The design of the Project Management Team, the Project Brief and the Business Case can be influenced by lessons learned from previous projects. Responsibilities Action PSC Qualify MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Senior Supplier Lessons Log Team Manager Project Support RP Benefits Capturing previous lessons learned from other projects has a lot of benefits including: • More effective Risk Management: By analysing how risks have been managed in past projects, the Project Management Team will be able to avoid some risks, or to create more effective risk response plans for the current project • Cost Reduction: mistakes sometimes are quite expensive and could be easily prevented with the correct information; a reduction in mistakes automatically leads to a cost reduction • Efficiency: as centrally stored, lessons learned reports are accessible for all project members at the moment they need that particular information • Continuous Improvement: by constantly optimizing the performance within projects and distributing that knowledge, the Agency will continuously improve itself Activity Summary TBD Completion Criteria It has been verified whether some Lesson Learned Reports are available ¨ Lessons Log has been created ¨ Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 31

eu-LISA PM Methodology Scalability and Templates Medium Projects Large Projects Project Logs (Lessons Log) Project Logs (Lessons Log) Small Projects Project Logs (Lessons Log) Best Practices It may be useful to hold a workshop as a mean to capture relevant lessons. Attendees could include any interested parties and people who have worked on previous similar projects. If the Agency has not done this type of project before, it may be helpful to include people external to the organization who have the relevant experience. References PRINCE2: Starting up a Project, Capture previous lessons Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 32 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU5 – Calibrate Business Case Purpose The purpose of this step is to ensure the proposed Business Case is still viable, desirable and achievable, and it reflects the most current conditions. INPUTS DESCRIPTION OUTPUTS • Business Case The Project Executive further • Updated Business Case • Lessons Log refines the Business Case, while • Project Product Description checking its initial content against current conditions affecting the project proposal. This process step triggers immediately after the Project Executive is appointed and may be performed in parallel with SU8 – Create the Project Brief. Although it might seem natural to calibrate first the Business Case (SU5), and then develop the Project Brief (SU7), in real-life situations the steps are mostly performed in parallel. Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Updated Business Case Create PR Project Product Description Create AP Benefits This process ensures that the initial Business Case is updated with current conditions, thus enabling an objective and facts-based decision-making process in further steps, especially Initiating a Project (IP). Furthermore, the Project Product Description is added to the Updated Business Case, ensuring that the project has a clearly defined output. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 33

eu-LISA PM Methodology Activity Summary The exact sequence and all of the possible interactions between these two process steps are difficult to represent on the process diagram, due to specific conditions that may vary from one project to another. As a general guidance, it’s best recommended that Project Executive and Project Manager will work collaboratively in performing the SU5 and SU7, in order to ensure consistency, synchronization and mutual support. The following areas are considered at this stage: • Resources o How many areas will be impacted by this project – both during any development work and following implementation? o Are departments and suppliers willing and able to provide key resources to support and deliver the project? o Is the project reliant on external contractors to deliver the change? • Dependencies o Is this proposal dependent on any other projects to succeed? o Are any other projects dependent for their success on this proposed project? • Scope and implementation o When is this project planned to be implemented? o What other projects are being implemented at the same time and resources availability/allocation? o What is the implementation approach – phased or ‘big-bang’? o Will other projects have to be moved forwards or backwards, or terminated, to accommodate this project? If so, which ones? Completion Criteria Lessons Learned have been considered ¨ Relevant Stakeholders have provided input and feedback ¨ The initial Business Case has been assessed against current conditions and organizational ¨ priorities Project Product Description has been added to the Business Case ¨ Scalability and Templates Small Projects Medium Projects Large Projects Business Case Business Case Business Case Project Product Description Project Product Description Project Product Description Best Practices TBD References PRINCE2: Starting Up a Project, Prepare the Business Case Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 34 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU6 – Appoint Project Management Team Purpose The purpose of this step is to ensure the project is properly staffed, so all required activities can be performed. INPUTS DESCRIPTION OUTPUTS • Updated Business Case • appoint people to: (Part of the PID): • Lessons Log • Project Assurance (where • Project Management Team appropriate) Role Descriptions • Team Management • ensure that these individuals • Project Management Team Structure understand their roles and responsibilities in the • Appointed Project management and support of Management Team the project • ensure that the individuals are actively committed to carrying out their roles and responsibilities • Confirm the reporting and communication lines. Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Project Management Team Role Descriptions Create AP Project Management Team Structure Create AP Confirm AP Appointed Project Management Team Benefits This process provides a structure for a project management team that enables: • Controlled delegation of some day-to-day management responsibilities, where required, to Team Managers • The right people, with the right skills and knowledge, are appointed in the right roles, with the right responsibility and the right authority level • Clear lines of communication between the project management team members Activity Summary TBD Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 35

eu-LISA PM Methodology Completion Criteria Appointees have skills, qualifications, knowledge and experience required to undertake their ¨ duties Provision has been made for any necessary training to fill any skill gap ¨ All roles and responsibilities have been allocated and exclusions are justified ¨ All relevant stakeholders are represented in the project management team ¨ All appointees have confirmed their availability and willing to undertake their duties ¨ Scalability and Templates Medium Projects Large Projects PID Extended PID Small Projects TO BE CREATED Basic PID TO BE CREATED Best Practices It will not always be possible to appoint the entire Project Management Team while the project is not fully defined, scoped or planned. However, at least key roles required to contribute in preparing the Project Brief shall be identified, defined and appointed. Expectations of what level of commitment is required from members of the Project Management Team should be clearly defined and agreed, for instance whether full or part time commitment is required. Lessons learned from previous projects may provide data on the possible commitment required by project team members on similar projects, or on the mix of skills and experience needed. References PRINCE2: Starting Up a Project, Design and appoint the project management team Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 36 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU7 – Create Project Brief Purpose The purpose of this process is to establish a firm foundation for initiating the project, by clearly articulating what the project needs to achieve. While the Business Case is providing the business justification for the project, the Project Brief defines what the projects has to accomplish, in order to deliver the benefits outlined in the Business Case. INPUTS DESCRIPTION OUTPUTS • Updated Business Case Project Manager will collect and • Project Brief • Project Product Description • Project Management Team Role document information covering Descriptions the following areas: • Project Management Team • Background information Structure • Project approach • Project objectives • Lessons Log • Project scope • Constraints and assumptions • Project tolerances • Interdependencies • Business Case (by reference) • Project Product Description (by reference) • Project Management Team Structure (by reference) • Project Management Team Role Descriptions (by reference) Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Project Brief Assemble AP Benefits A comprehensive, yet brief, Project Brief establishes a shared understanding on what the project is supposed to achieve, which helps developing project plans and communicate effectively with all stakeholders. Activity Summary TBD Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 37

eu-LISA PM Methodology Completion Criteria All relevant stakeholders have provided input ¨ Project Objectives are SMART ¨ Content of the Project Brief is consistent with the Business Case ¨ Scalability and Templates Medium Projects Large Projects Project Brief Extended Project Brief Small Projects Basic Project Brief Best Practices TBD References PRINCE2: Starting Up a Project, Select the project approach and assemble the project brief Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 38 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA SU8 – Plan the Initiation Stage Purpose The purposes of this process is to ensure that work and resources required for initiating the project are properly planned. Since initiating the project involves activities and resources like any other activity in a project, this stage should be properly planned before doing the actual initiating work, like any other project activity. INPUTS DESCRIPTION OUTPUTS • Project Brief • Identify and decide upon • Initiation Stage Plan • Lessons Log suitable management controls • Request to Initiate the Project for initiation • Identify and document time and cost constraints for initiation • Review risks and assess their impact on initiation • Produce the Stage Plan for initiation • Request authorization to initiate the project Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Initiation Stage Plan Create AP Benefits • By planning the Initiating a Project stage, the effort and resources required to perform this work are known in advance • Actual progress can be measured • Inter-dependencies with other projects/programmes or other operational work are identified and addressed Activity Summary TBD Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 39

eu-LISA PM Methodology Completion Criteria Lessons Log has been reviewed ¨ Management controls suitable for Initiate a Project have been established ¨ Effort, duration and resources have been estimated ¨ Constraints and other inter-dependencies with other projects have been identified and ¨ documented Resources have been identified and appointed ¨ Risks associated with Initiating a Project stage have been identified and addressed through ¨ proper risk response plans The Initiation Stage Plan has been reviewed and checked for consistency ¨ The Request to Initiate a Project has been sent to PSC ¨ Scalability and Templates Medium Projects Large Projects Stage Plan Extended Stage Plan Small Projects Basic Stage Plan TO BE ADJUSTED TO BE ADJUSTED Best Practices The level of detail in developing the Stage Plan for Initiating a Project should be adjusted depending on the project size and complexity. It is expected that large projects will require more effort and resources in the Initiating a Project stage, therefore the planning should be more detailed for such cases. References PRINCE2: Starting up a project, Plan the initiation stage Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 40 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA 19. Initiating a Project (IP) The purpose of the Initiating a Project process is to understand the work that needs to be done to deliver the required products. This understanding is formalised in the form of a Project Initiation Document, so that there is common agreement on: • the adequacy of reasons for doing the project • what key products the project will deliver • how and when these will be delivered and at what cost • the scope of what is to be done • any constraints which apply to the product to be delivered • any constraints which apply to the project • who is to be involved in the project decision making • how the quality required will be achieved • what risks are faced • how the project is to be controlled Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 41

eu-LISA PM Methodology IP1 – Develop Management Strategies Purpose The PID must contain several pieces of information that are vital to the success of a project. Among them there are 4 types of strategies that should be defined and implemented following the specific needs of the project. INPUTS DESCRIPTION OUTPUTS • Business Case Risk Management Strategy Part of the PID: • PID The Risk Management Strategy describes the techniques that will • Risk Management Strategy be used for identifying, assessing • Risk Log and controlling risks during the • Configuration Management project. Quality Management Strategy Strategy The Quality Management Strategy describes how the • Quality Management Strategy project will meet the users’ • Communication Management quality expectations and identifies who is responsible for Strategy quality aspects. Configuration Management Strategy The Configuration Management Strategy defines the approach that will be taken to identify, track and safeguard the project assets. Consequently, the Project Manager can track their status as they evolve throughout the project lifecycle. This document also defines the issue and change control procedures that will be applied to the project. Communication Management Strategy The Communication Management Strategy defines the method and frequency of communication between all interested parties from the PSC to the project Support Team. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 42 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Risk Management Strategy Create AP Risk Log Create AP Configuration Management Strategy Create AP Quality Management Strategy Create AP Communication Management Strategy Create AP Benefits The use of a Management Strategies ensures that both the user and the supplier of the final products are aware of the control standards and processes to be followed. In particular: • Risk Management Strategy ensures that the project team are conscious on how risks will be managed during all the projects activities and who is responsible for identifying the risks. • Quality Management Strategy ensures that the focus on quality products is not lost or reduced. • Configuration Management Strategy is essential for the project to maintain control over its management and specialist products. • Communication Management Strategy ensures that communication activities are structured and efficiently planned, thus avoiding duplication of effort. It also ensures that communications are timely and appropriate to the needs of each group of project stakeholders. Activity Summary TBD Completion Criteria Responsibilities for each management strategy within the project are clearly understood and ¨ documented ¨ All stakeholders have been identified and their communication requirements defined ¨ ¨ Identified stakeholders have agreed to the content and method of the strategies Risk Log has been created and initialized Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 43

eu-LISA PM Methodology Scalability and Templates Medium Projects Large Projects PID Extended PID Small Projects TO BE CREATED Basic PID Project Logs (Risk Log) Project Logs (Risk Log) TO BE CREATED Project Logs (Risk Log) Best Practices The importance of regular communication both within the project and from the project to stakeholders should be emphasised. In most cases it is better to over-communicate than not at all. Stakeholders may not simply be those with a direct interest in the project, such as the Project Executive or final users. There may be other stakeholders who have an indirect interest in the project. It is important not to lose sight of these groups and to consider how their communication needs should be met. The methods of communication used should be appropriate to the content of the message. For example, face- to-face meetings may be more appropriate when dealing with sensitive issues, while email may be more suitable for general project updates. The success or otherwise of communication activities conducted during the project should be reviewed at regular points to ensure that material and methods continue to be appropriate as the project advances. References PRINCE2: Prepare Risk Management Strategy PRINCE2: Prepare Configuration Management Strategy PRINCE2: Prepare Quality Management Strategy PRINCE2: Prepare Communication Management Strategy Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 44 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA IP2 – Create Draft SSRS & PIA Purpose The purpose of this step is to ensure the project will comply with Security and DP requirements. INPUTS DESCRIPTION OUTPUTS • PID After gathering functional • SSRA • Project Logs requirements for a project, an • Part of the PID: assessment to derive relevant security and data protection o SSRS requirements will be conducted. o PIA Even if the project is being developed by a third-party, these requirements, once identified, should be included in the PID. Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Security Officer DPO SSRA Create RP SSRS Create RP PIA Create RP Benefits Addressing security and data protection requirements from the early phases of a project development is the most cost-effective way of preventing security and data protection defects. Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 45

eu-LISA PM Methodology Activity Summary For each functional requirement, the Project Manager with the support of the Security Officer and/or the DPO should lead stakeholders through the process of explicitly noting any expectations with regard to security and data protection. Typically, questions to clarify for each requirement include expectations for data security, access control, transaction integrity, criticality of business function, separation of duties, etc. Based on this first assessment, if is established that the requirements are related to security area, the Security Officer should produce, in collaboration with the Project Manager, the System Specific Risk Assessment (SSRA) document. Based on the SSRA a System Specific Security Requirements (SSRS) document should be then produced by the Security Officer in collaboration with the Project Manager. These 2 documents, the draft SSRA and SSRS will be then integrated in the PID that will be submitted to the Management Board for review and approval. If is established that requirements are related to data protection area, the DPO should produce the Privacy Impact Assessment document in collaboration and with the support of the Project Manager. The draft PIA will be then integrated in the PID that will be submitted to the Management Board for review and approval. The test scope and plan for both Security tests and DP tests/assessments have to be agreed and embedded in the PID planning. Completion Criteria ¨ ¨ It has been established whether the project has requirements related to security area ¨ It has been established whether the project has requirements related to data protection area ¨ A Security Officer has been designated for the project ¨ The Security Officer has been involved in the requirements review The DPO has been involved in the requirements review Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 46 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA Scalability and Templates Small Projects Medium Projects Large Projects SSRS SSRS SSRS TO BE CREATED TO BE CREATED TO BE CREATED PIA PIA PIA TO BE CREATED TO BE CREATED TO BE CREATED Best Practices The review of requirements against security and data protection aspects should be performed with the collaboration of a Security Officer and/or the DPO with input from business stakeholders. Senior developers, architects, and other technical stakeholders should also be involved to bring design and implementation- specific knowledge into the decision process. References TBD Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 47

eu-LISA PM Methodology IP3 - Develop Project Management Plan Purpose A management plan is the backbone of every project and is essential for a successful outcome. This process ensures the production of an effective project plan. The project plan forms a key component of the Project Initiation Document. It is important to note that the creation of a sound project plan is an iterative process which should involve regular consultation and validation with key project stakeholders. INPUTS DESCRIPTION OUTPUTS • PID The Project Plan is more than just • Project Management Plan (part • Project Product Description a Schedule and it should content of the PID) • Project Logs the following elements: o Product Breakdown • Plan description – what the Structure o Schedule project plan covers and the o Budget planning approach o Payment Schedule • Plan prerequisites – aspects that must be, and must remain • Configuration Item Records in place for the project plan to be successful. • External dependencies - any that may influence the project plan • Planning assumptions – any stated assumptions up which the project plan rests. • Lessons incorporated – details of relevant lessons from similar projects. • Monitoring and control – how the plan will be monitored and controlled. • Budgets – covering time and cost, including provisions for risk and change. • Payment Schedule – includes all the information related to the payment schedule of all procurement contracts within the scope of the project • Tolerances – time and cost, benefits, scope and quality – whatever tolerances that are set for this particular project plan. • Product Description – listing all product descriptions whose products will be created during the scope of this project plan. Date: 17/04/2020 eu-LISA LIMITED BASIC P a g e | 48 Version: v 6.0.3

eu-LISA LIMITED BASIC Releasable to eu-LISA PM Methodology eu-LISA • Schedule – Gantt (e.g. MS Project) Responsibilities PSC MPB (P) Producer EPMO (R) Reviewer Project Executive (A) Approver Project Manager Project Assurance Product Action Senior Supplier Team Manager Project Support Project Management Plan Create AP Configuration Item Records Create/ Update AP Benefits • Allows the Project Manager to maintain day-to-day control • Gives the Program Board a mechanism for viewing project progress • Establishes the duration, resource effort and budget of the project and provides a baseline for the project to be measured against • Breaks down the project into meaningful and manageable components Activity Summary TBD Completion Criteria All products are identified ¨ Types of resources required have been identified ¨ The tasks which, if they slip, will delay the whole project/stage (also known as the critical path), ¨ have been identified Key milestones have been identified and incorporated ¨ Risks and potential issues have been identified and risk management activity has been described ¨ into the plan Scalability and Templates Medium Projects Large Projects Project Management Plan Extended Project Management Small Projects Basic Project Management Plan Plan TO BE ADJUSTED TO BE ADJUSTED Configuration Item Records Configuration Item Records Configuration Item Records Project Schedule Project Schedule TO BE ADJUSTED TO BE ADJUSTED Project Schedule TO BE ADJUSTED Best Practices Sensitivity: LIMITED BASIC Date: 17/04/2020 Version: v 6.0.3 P a g e | 49