MyMIS Two primary sources of uncertainty in the risk management process are: (a) unknown precision of the methodology used; and (b) difficulty to determine the exact value of the various elements in the risk model such as threats frequency, potential damage etc. Projections and assumptions can be indeterminate. It is possible that a data source is uncertain. Normally, data is collected from two sources; statistical data and expert analysis. However, there are potential problems from both sources. For example: samples taken may not be reflective of the true situation; missing or not properly counted parameters; misleading results and insufficient data. When expert analysis is done, it should be recognised that projections are subjective and the assumptions are always questionable. 2.4 Incorporating Public Sector ICT Security into the System Life Cycle The purpose of incorporating the Public Sector ICT Security Plan into the ICT System Life Cycle is to ensure that the Public Sector ICT Security component is not overlooked. Since ICT has played an irreversible role in service delivery in the public sector, the planning of ICT systems should always include Public Sector ICT Security at the very onset. The Public Sector ICT Security Plan should be viewed as a documentation of the structured process to plan for adequate, cost-effective Public Sector ICT Security protection for the overall system. 2.4.1 Might be too expensive to incorporate later. Also can cause delay, disruption, etc. Benefits of Integrating Public Sector ICT Security in the System Life Cycle It is recommended that the Public Sector ICT Security Plan be developed at the beginning and incorporated into the system life cycle. It would be difficult and expensive to redesign the applications to cater for security features at a later stage. Moreover, it can cause project delays, disruptions, diminish expectations and overall low morale. Furthermore, it is virtually impossible to anticipate the whole array of security problems that would deter the incorporation of the Public Sector ICT Security Plan at the later stages of the system life cycle. Updating the security plan, at least, at the end of each phase in the system life cycle can minimise issues. The documentation of decisions related to Public Sector ICT Security into the system life cycle should help assure management that Public Sector ICT Security is fully addressed in all phases including applicable legislation and other requirements. 2.4.2 5 stages of ICT system life cycle. Copyright MAMPU The ICT System Life Cycle Phases It is recommended that planning for Public Sector ICT Security follow the stages described in most models of ICT System Life Cycle consisting of the following five (5) basic stages, incorporating ICT security issues in each stage and as depicted in Figure 2.1: Chapter 2 - 9