Page 2.4 Incorporating Public Sector ICT Security into the System Life Cycle 2.4.1 2.4.2 2.5 Benefits of Integrating Public Sector ICT Security in the System Life Cycle 2 - 9 The ICT System Life Cycle Phases 2 - 9 Public Sector ICT Security Assurance 2 - 11 2.5.1 Design and Implementation Assurance 2 - 11 2.5.1.1 Testing and Certification 2 - 11 2.5.1.2 Conformance Testing 2 - 12 2.5.1.3 Use of Reliable Architectures 2 - 12 2.5.1.4 Ease of Safe Use 2 - 12 2.5.1.5 Evaluation and Reviews 2 - 12 2.5.1.6 Assurance Documentation 2 - 13 2.5.1.7 Certification of Product to Operate in Similar Situation 2 - 13 2.5.1.8 Self-Certification 2 - 13 2.5.1.9 Warranties and Liabilities 2 - 13 2.5.2 2.6 2 - 9 2.5.1.10 Distribution Assurance 2 - 14 Operational Assurance 2 - 14 2.5.2.1 Audit Methods and Tools 2 - 14 2.5.2.2 Monitoring Methods and Tools 2 - 16 Operational Assurance Issues Chapter 3 BASIC OPERATIONS 2 - 18 3 - 1 3.1 Information Classification 3 - 1 3.2 Roles and Responsibilities 3 - 2 3.2.1 Head of Department 3 - 2 3.2.2 Chief Information Officer 3 - 3 3.2.3 Computer Manager 3 - 3 3.2.4 ICT Security Officer 3 - 4 3.2.5 System Administrators 3 - 5 3.2.6 Help Desk 3 - 5 3.2.7 Users 3 - 5 3.2.8 Vendors, Contractors and External Service Providers 3 - 6 vi