MyMIS 4th stage: Operation/Maintenance - This is the stage where the developed system runs alongside the daily operations of the department. As the system matures, expansion through additional equipment and application systems is inevitable. New requirements may become apparent and obsolete functions may need to be removed. 5th stage: ICT Security Assessment - This is the stage where an assessment is made to determine whether ICT Security requirements are met. At each of the five (5) stages, additions or deletions to the existing system may take place. Therefore the security aspects must be considered for each activity in every stage. 2.5 2 rule of thumb questions. Public Sector ICT Security Assurance The Public Sector ICT Security assurance means the confidence level in the Public Sector ICT Security safeguards to operate correctly as planned. The effectiveness of ICT security is not easy to assure because of the difficulty in quantifying assurance. As a rule of thumb, two (2) questions should be asked: (a) who needs to be assured; and (b) what type of assurance is required. There are many methods and tools available. Two (2) of these are described below: Design and Implementation Assurance; and Operational Assurance. 2.5.1 Design and Implementation Assurance The design and implementation assurance means that the design features of the ICT system, its operations or ICT assets must meet requirements and specifications. Assurances of this nature require the examination of the ICT system design, the correct functioning of each application and the manual processes that support it. Design and implementation assurance is associated with the development, testing, as well as pre- and post-implementation stages of the ICT system life cycle. The design and implementation assurance seeks to address whether the end product complies with the agreed Public Sector ICT Security specifications. It is also used to provide evidence of deviation and remedial action. The following sub-sections suggest some of the major methods that can be adhered to in achieving design and implementation assurance. 2.5.1.1 Testing to ensure compliance to requirement and quality. Copyright MAMPU Testing and Certification Testing is an activity to quantify compliance to stated requirements. In addition, it can be used to address the quality of the ICT system as it is being built, implemented and operated. Therefore, the testing should be performed throughout the development cycle or wherever proof of compliance is required. Chapter 2 - 11