MyMIS Assurance by digital signature, anti-virus software. 2.5.1.10 The assurance of ICT products obtained via electronic distribution is important. In such a situation, the distribution of unmodified copies and its integrity can be ascertained through the use of digital signature or check-bits. Sources downloaded from unknown origin such as bulletin board should be verified by anti-virus software at the very least. 2.5.2 Operational assurance addresses technical issues. Distribution Assurance Operational Assurance Whilst design and implementation assurance addresses the quality issues, operational assurance seeks to address technical features such as vulnerabilities, conformance to procedures and changes to Public Sector ICT Security requirements. The ICT system being a ‘living’ system changes over time. Some causes of change include changes to the ICT system due to expansion of scope, operating systems or threat environment. The operational performance of ICT systems tends to degrade over time. Creative users and operators resort to new ways to bypass Public Sector ICT Security measures with the sometimes incorrect perception that it may improve performance. It is very rare where adherence to procedures is strictly followed. In some instances this can produce disastrous results for the administration of the ICT system. There are two basic methods to observe operational assurance: (a) ICT System Audit This can be either a scheduled or an unscheduled event to evaluate Public Sector ICT Security. It is important to define the scope of work since the auditing process can easily be side-tracked towards less important issues. The auditing process can both be investigative in nature (to resolve specific issues) or developmental. (b) Monitoring This is one of the most effective mechanisms to ensure operational assurance. However this activity is time consuming and requires more resources. It involves periodic checks on the overall ICT system including user activities, standard operating procedures, the environment etc. 2.5.2.1 Auditing needs to be developmental rather than fault-finding. Copyright MAMPU Audit Methods and Tools All audits conducted on public sector ICT installations, environments or premises should follow stated or implied Public Sector ICT Security Policy and Public Sector ICT Security Auditing Guidelines or other documents published later. In conducting the ICT audits, the audited department plays a crucial role in extending assistance. The audits have to be treated as developmental and not as a fault-finding exercise. It is best for the government if the audited department and the audit team identify the appropriate Public Sector ICT Security requirements (which may be additional) based on the existing ICT environment. The audit conducted should not interrupt the business operation of the audited department. Three (3) different types of auditing methods with respect to depth and objectives are described in the following paragraphs. Chapter 2 - 14