What it asks for. Information security should be integrated into project management. Security requirements and risks should be considered throughout a project, whatever its type.
In practice. The project methodology includes security checkpoints, such as a security risk assessment at initiation, requirements in the design phase and a sign off before go live. This applies to all projects, not only IT development, including office moves, acquisitions and process changes. Project managers know when to involve security and privacy specialists. Evidence includes project templates with security steps, completed risk assessments and records of security sign off.
Common gaps. Security is often brought in just before go live, when changes are expensive. Business led projects, especially SaaS purchases, frequently skip the methodology altogether.