MyMIS and non-monetary factors are involved. For example, it may be effective from an economic and safety viewpoint to impose a new locking mechanism rather than to employ a security guard. In the assessment of risks other than monetary issues, there will be areas where it is not obvious as to what kind of safeguard is appropriate. ICTSOs and ICT managers need to consider many factors in identifying the safeguards The other factors that should be considered by ICTSOs and ICT Managers are: (a) legislation, regulation and organisation policy; (b) user and business requirements; (c) ICT system performance requirements; (d) timeliness, accuracy, and completeness requirements; (e) the life cycle costs of Public Sector ICT Security measures; (f) the relative strength of the proposed safeguard; (g) the reliance of other safeguards being considered; (h) technical requirements; and (i) cultural constraints. 2.3.5 Not possible to mitigate all risks and threats Need to make decision on which ones It is not possible to mitigate all risks and threats identified because, in reality, all ICT installations operate on limited resources. The management needs to decide what risks should and can be mitigated. The remainder of the risks not mitigated is generally known as residual risks. Once this type of risk has been identified based on priority ranking, a decision has to be made as to whether these risks are acceptable or otherwise. Managing residual risk should not severely affect the delivery of services and should be properly documented and monitored over time. Such residual risks should be quantified as far as possible and additional safeguards should be implemented if they are considered too high. The decision to balance between acceptable and unacceptable risk is a management decision. 2.3.6 Once decision is madeneed for follow-through Need to maintain, ensure it is ongoing Need for periodic assessments Copyright MAMPU Implementing Safeguards and Monitoring Effectiveness Once a decision has been made to implement the appropriate safeguards, the decision must be followed through. There is also the requirement that the safeguards be maintained and this process must be seen as ongoing, for inappropriate maintenance can render the safeguards ineffective. Also, it calls for periodic assessments to improve the safeguards with possible requirement for re-analysis of risk. 2.3.7 Uncertainty analysis attempts to document grey areas Managing Residual Risks Uncertainty Analysis There will be instances when the management of risk relies on hearsay, speculation, best guess, assumption and incomplete data. Uncertainty analysis attempts to document this grey area so as to keep management informed and aware. Chapter 2 - 8