List all activities during the year:
- Mgt review
- Salary revisions
- Vacation
- Public holidays
Medical software:
- Vulnerability scanning twice a year
- GDPR and HIPAA training yearly
- Cyber security review
- Supplier re-evaluation
Involve all departments
Understand which activities are flexible and which have fixed deadline
Put the activities over the year based on
- Input/Output
- Resources