MyMIS Issue a plan of action The management may find it appropriate, for example, to issue a plan of action on how the ministry/state should approach contingency planning (example centralised vs. decentralised) or the use of a particular methodology for mitigating a particular risk to ICT systems. Ministry/State wide plans may be appropriate when new issues arise, such as integration to legacy systems that may possibly require additional protection of some particular information. While the Central Level broad-based policy may not require much modification over time, ministry/state policy formulation will likely require more frequent revision as changes in technology, demands, requirements, legislation and business rules take place. 2.1.3 Departmental Level Operating at the action level Operating or System-specific level focuses on actions taken to protect a particular system. This is operating at the action level where detail knowledge on procedures, standard, and guidelines are the daily norm. The operating level or system specific provides detail information to address issues While the Central and Ministry/State Specific Levels address issues from a broad perspective encompassing the entire organisation, they do not provide detailed information for example, on establishing application priorities, access controls and other specific requirements. This is where the departmental level or specific programme is needed. The operating level security policy has important impact on system and its security Departmental Level security policy is applied at the computer system operations level and may vary from system to system even within the same organisation. The departmental security policy has an important impact on system usage and safeguarding Public Sector ICT Security. The decision to adopt a departmental ICT Security Policy for the organisation can be made at the managerial level. Refer to Appendix D: Example of Contents List for an Agency/Department ICT Security Policy for guidelines on formulating policy. 2.2 Public Sector ICT Security Programme Management Programme management is important This sub-section discusses the importance of programme management and presents an organisation-wide approach in managing Public Sector ICT Security. Programme management among others encompasses nominating ICT Security Officers, developing security policies, carrying out security audits and providing ICT security incident response and handling services. In this respect, it is noted that the various ministries, departments and agencies in the public sector differ vastly in function, size, complexity, management style and culture. 2 different levels of programme management In comparison to Public Sector ICT Security Policy formulation, there are only two (2) different levels of programme management. The higher level is the Central Level, which is responsible for overall strategy, co-ordination, planning and implementation as well as advice and direction on ICT security issues. Next is the Operating Level, which encompasses both ministry/state and department. ICT security programme management at this level details the procedures for implementing cost-effective ICT security. Copyright MAMPU Chapter 2 - 3