MyMIS (d) competence; (e) integrity of the evaluating body; and (f) assumptions made. 2.5.1.6 Describing how ICT security requirements are met. Assurance documentation is one that describes Public Sector ICT Security requirements and how they are met when compared against these requirements. The significance of assurance documentation is the indication of the degree of understanding as portrayed by the designers, and their presumed ability to construct solutions to meet the necessary Public Sector ICT Security requirements. Please refer to Appendix F: A Sample ICT Security Adherence Compliance Plan for guidance on compliance programmes. 2.5.1.7 Assurance to operate products in different environments. Assurance Documentation Certification of Product to Operate in Similar Situation There will be instances when a department seeks clarification that the ICT Security product it is about to procure operates seamlessly in its current environment. This may be the case for departments that operate on proprietary systems wishing to employ products outside their operating environment. Most producers of ICT Security products, with very good reputation produce documentation, brochures and advertisement statements of certification of their ICT Security products that operate in similar situations. However, it should be realised that certification to operate in a similar situation is environment specific, since it may be certified to operate in one environment but may not work in another, even though the certification is performed by the same body. The risks are high if the products to be procured and used at the required department are non-certified products. It might be a better decision to opt for other certified products. Certification should be nationally accepted. 2.5.1.8 Test conducted by vendors or suppliers can be indicators. In many instances the software vendor or the system integrator of the ICT Security system conducts self-certification of their own products. This is done to determine or at least provide some indication the quality and performance of their products. This technical evaluation may not be partial but does provide a minimum degree of assurance. In cases where a high degree of assurance is required, a third party independent evaluation is recommended. 2.5.1.9 Undertaking to correct errors and provide upgrades. Copyright MAMPU Self-Certification Warranties and Liabilities This is another form of assurance where the manufacturer or integrator provides an undertaking to correct errors or provide upgrades via version releases. It can be in the form of a formal declaration or certification of the product or published assertion. The manufacturer’s commitment is seen through its endorsement to correct errors and indemnify loss or damage should the product be non-conforming. Chapter 2 - 13