MyMIS Action by ministry and department At the operating level, the ministry or department should embark on: (a) formulating departmental ICT security policy; (b) undertaking ICT system life cycle management with respect to security; (c) providing ICT security awareness and training; (d) testing Business Resumption Plan; and (e) conducting scheduled ICT security review. 2.3 Public Sector ICT Security is a continuous process Need to ensure security is within an acceptable risk level Public Sector ICT Security Risk Management Security can be defined as a condition that is free from threats and unacceptable risks. Public Sector ICT Security should be looked upon as a continuous process. It involves periodic activities that must be implemented to ensure that security is within an acceptable risk level, taking into consideration technology change that brings with it rapidly changing threats and vulnerabilities. Principal objective is to ensure business continuity The principal objectives of securing ICT assets are to ensure government operations continuity and minimise disruptions or damage by preventing and minimising the impact of security incidents. ICT security aims at facilitating information sharing and simultaneously ensuring the protection of the information and ICT assets. In order to achieve the desired Public Sector ICT Security acceptance level, the vehicle used in assessing risk is aptly termed Public Sector ICT Security Risk Management. By definition, risk management is the process of assessing risks, taking steps to mitigate the risks to an acceptable level, accepting and monitoring the residual level of risks. A sample of ICT Security Risk Management process is as in Appendix E. Steps for better risk management include identifying risks, evaluating risks and implementing safeguards Steps required for better risk management includes: (a) formation of a risk management committee; (b) identifying the risks and threats; (c) evaluating the risks and threats; (d) identifying the necessary safeguards and counter measures; (e) managing residual risk; (f) implementing safeguard and monitoring effectiveness; and (g) undertaking uncertainty analysis. 2.3.1 Representation on Risk Management Committee Formation of Risk Management Committee Risk analysis should be co-ordinated by the ICTSO and are best performed by a team of individuals representing the following disciplines: (a) data processing operations management; (b) systems programming (operating systems); (c) systems analysis; (d) applications programming; (e) data base administration; (f) auditing; Copyright MAMPU Chapter 2 - 5