MyMIS Operation/ Maintenance Determine ICT Security Requirements (including Risk Assessment) Install/Turn on ICT Security Safeguards ICT Security Operations and Administration Incorporate ICT Security Requirements into Specifications ICT security Testing (including certification) Operational Assurance (Monitor/ Audit) ▲ Implementation ▲ Disposal of Obsolete measures Development/ Acquisition ▲ ▼ ▲ ▲ Planning for Change ICT Security Assessment Managing Change ▼ ▼ Obtain the system (build/buy and related ICT Security Activities) Accreditation ▼ Periodic Re-accreditation Figure 2.1: ICT Security in the System Life Cycle Phases 1st stage: Planning For Change - This is to plan for the changes that will occur with the implementation of the new ICT system to meet operational and Public Sector ICT security requirements. This exercise can be very daunting, as it will involve practically everyone in the organisation especially in areas such as retraining, adaptation and the inception of completely new procedures. 2nd stage: Development/Acquisition - This is the stage where the ICT system is being constructed, programmed, developed or purchased. The Public Sector ICT security requirements based on core business functions, ICT asset value and risk assessment should be included in this stage. 3rd stage: Implementation - This is the stage where, upon final acceptance by the government, the ICT security safeguards are initiated. Copyright MAMPU Chapter 2 - 10