MyMIS Important factors to consider in formulating the ICT Security Policy Essentially the ICT Security Policy document should state: (a) the ICT Security Policy statement; (b) the rationale behind ICT security in protection against unauthorised access, ensuring availability and minimising security breaches; (c) the ICT security definition inclusive of coverage of assets to be protected; (d) the objectives of ensuring government operations continuity and to minimise disruptions by minimising impact of security incidents; (e) the security principles adopted; (f) the establishment of a clear management framework defining general and specific responsibilities for ICT security management, including reporting security incidents; (g) the need for ICT security awareness training for all staff and specific security training for those with greater responsibilities; and (h) the understanding of the requirement for shared responsibility in protecting government information. There are three (3) different levels of Public Sector ICT Security Policy formulation. The higher level is the Central Level that provides the general policy direction. The next level is the Ministry/State Level that addresses specific issues and the Departmental Level handle operational issues. 2.1.1 MAMPU is at the Central Level of formulating ICT policies for the public sector Central Level This is the top most management level that initiates ICT Security within the public service. This role has been entrusted to Malaysian Administrative Modernisation and Management Planning Unit (MAMPU), Prime Minister’s Department. MAMPU initiates and maintains the Public Sector ICT Security Policy Framework and is the referral centre on Public Sector ICT Security issues. The high level policy issued as a General Circular 3/2000 dated 1 October 2000 (Pekeliling Am Bil. 3 Tahun 2000 bertarikh 1 Oktober 2000) provide the direction towards securing government ICT assets (Appendix A). The policy: (a) defines the purpose and scope; (b) assigns the responsibilities for programme implementation; and (c) principles adopted. 2.1.2 Ministry/State Level Specific issues affecting particular organisation Issues addressed at this level are normally specific issues of concern affecting particular organisation or across the public service such as the disposal of unwanted computing equipment or backup of sensitive data. Issue-specific level focuses on local areas or current issues While the Central Level policy is intended to address the broad Public Sector ICT Security programme, the ministry/state level ICT management statements are developed to focus on specific areas currently relevant and of concern to the ministry/state. Copyright MAMPU Chapter 2 - 2