MyMIS 3.2 Roles and Responsibilities Management involvement is critical to ICT security. Capital expenditures alone cannot accomplish security. Management concern and effort are needed to plan, guide, motivate, and control an effective ICT security programme via the formation of ICT Security forum. A balanced programme, with proper concern for practicality and human values, will enhance the overall effectiveness of the information processing function. 3.2.1 Roles of Head of Department Head of Department Heads of Department are owners of Public Sector ICT assets and are accountable for their safe-keeping and protection. Essentially, the Head of Department should realise the importance of Public Sector ICT Security before it is implemented across the entire organisation. The Head of Department needs to be responsible for and supportive of ICT security programmes, promote compliance to standards, procedures and guidelines, and align Public Sector ICT Security requirements to the department’s missions and objectives. In addition, the Head of Department should ensure adequate resources, both financial and personnel, are available for the programmes. The roles and responsibilities of the Head of Department include: (a) ensure all users including government employees, vendors and contractors understand the need for Public Sector ICT Security policy, standards and guidelines; (b) ensure all users including government employees, vendors and contractors abide by the Public Sector ICT Security policy, standards and guidelines (necessary action must be taken upon non-compliance of any security measure); (c) undertake evaluation of risk and security programmes based on the Public Sector ICT Security policy, standards and guidelines; (d) develop an Adherence Compliance Plan for the purpose of managing risk arising from non-compliance of the Public Sector ICT Security policy, standards and guidelines; and (e) report to MAMPU and other relevant authorities as required under Mekanisme Pelaporan Insiden Keselamatan Teknologi Maklumat dan Komunikasi (ICT) - Pekeliling Am Bil. 1/ 2001 dated 4 April 2001 the following: i. information loss or unauthorised information disclosure or suspected information loss or suspected unauthorised disclosure; ii. unauthorised or suspected unauthorised usage of ICT system; iii. loss, stolen or unauthorised disclosure of access control mechanisms or passwords or suspected loss, stolen or unauthorised disclosure of access control mechanisms or passwords; iv. unusual systems behaviour such as missing files, frequent crashes and misrouted messages; and v. attempted ICT break-ins and untoward security incidents. Copyright MAMPU Chapter 3 - 2