Typical reasons information security technology projects fail: 

• Deadline is arbitrarily set based on compliance date vs. what is feasible.
• Trying to leverage a compliance issue to justify a larger scope security project within the same short window.
• Not using building blocks approach when defining project scope (we bite off too much at once).
• Not having the right skills internally to evaluate / implement solution (strategy, PM, and technical).
• The company lacks the experience in deploying a particular technology to identify the common pitfall areas (timeline / budget busters).
• Lack of real executive buy in. We don’t take the time to really explain the benefits to the company (not just meeting a compliance deadline).
• Lack of alignment with actual corporate goals/objectives.
• Ignoring obvious cultural / personnel roadblocks (hope for best strategy).
• Rushing through the strategy and business case phases (i.e. not having realistic ROI figurers, no proven strategy, underestimating the soft costs of the project).

Best Practices in this area:

- Focus on which “reasons for failure” are most likely to affect your security project and address them early on.

- Take the time to really understand your compliance deadline date (Is it a real hard date with financial implications?) Even so, understand the potential fines involoved so you analyze them in your business case.