MyMIS 2.2.1 Central Level ICT Security programme components Central Public Sector ICT Security Programme Management At the Central Level, ICT security programme management consists of the following: (a) formulating Public Sector ICT Security Policy Framework; (b) ICT Security Awareness and Training; (c) ICT Security Incident Response and Handling; (d) ICT Security Posture Assessment; (e) ICT Security Business Resumption Plan Framework; and (f) enforcement, audit and supervision. Benefits of ICT Security programme A central Public Sector ICT Security programme should provide three distinct types of benefits: (a) Increased Efficiency and Economies of Scale of Public Sector ICT Security; (b) Efficient, Economic Co-ordination of Information A co-ordinated centralised programme can assist in the collection and dissemination of ICT Security related information efficiently throughout the Public Sector. Since it is centrally controlled, various information can be channelled directly to the respective Public Sector ICT Security Officer at the various agencies; and (c) Central Enforcement and Supervision One of the functions of the Central Level is the evaluation of enforcement activities and compliance. In this regard, the organisation needs to understand the business requirements, issues, vulnerabilities and Public Sector ICT Security discrepancies internally. This could be done through an internal supervisory function that allows a firsthand look at ICT issues without the potential embarrassment of an external audit or investigation. 2.2.2 Scope of Operating Level Public Sector ICT Security Programme Operating Level Public Sector ICT Security Programme Management Unlike the central programme that addresses the entire spectrum of Public Sector ICT Security, the operating level addresses the procedures for implementation of appropriate and cost-effective ICT security. Some of the salient items in considering the operating programme are: (a) implementing safety measures; (b) selection and installing of safety measures; (c) day-to-day Public Sector ICT Security administration; (d) evaluation of ICT system vulnerabilities; and (e) responding to Public Sector ICT Security problems. Local advocate The local advocate for the security programme at this level is the ICT Security Officer (ICTSO). This officer is nominated by the ministry or department as suggested in the Public Sector ICT Security Policy Framework. Copyright MAMPU Chapter 2 - 4