MyMIS 3.2.2 Roles of CIO–Strategic Planner of Public Sector ICT Security Chief Information Officer The Chief Information Officer (CIO) is another important ICT resource person. The roles and responsibilities of the CIO include: (a) support the Head of Department in discharging Public Sector ICT Security responsibility; (b) transform the responsibilities above into an effective action plan; (c) incorporate Public Sector ICT Security requirements into existing CIO functions i.e. preparing the IT Strategic Plan. A sample ICT Strategic Plan is as per Appendix G; and (d) in some cases, the CIO is also the Departmental Security Officer. 3.2.3 Roles of Computer Manager Computer Manager The Computer Manager acts as the Operational Head of ICT and is responsible for managing Public Sector ICT Security at site. The Computer Manager supervises and monitors personnel in the department and acts as the key player in ICT security programme. The roles and responsibilities of the Computer Manager include: (a) understand, support, and abide by the Public Sector ICT Security Policy, standards (MS ISO/IEC 13335 part 1-3, MS ISO 17799 part 1) and MyMIS; (b) ensure that all users understand, support and comply with the Public Sector ICT Security policy, standards and guidelines; (c) implement ICT security controls consistent with the requirements of the department; (d) create a positive atmosphere that encourages all users to report on ICT security concerns; (e) define realistic ‘need-to-know’ or ‘need-to-restrict’ criteria to implement and maintain appropriate access control; (f) review physical security safeguards, in consultation with the Chief Government Security Officer, Public Sector ICT Security officer and others, as required. (Physical security should not only address the central ICT installations only but also back-up facilities and office environments); (g) ensure that ICT security reviews are performed as and when required either by internal policy, regulations or ICT security concerns. Some examples of circumstances that trigger such a review include: i. large loss from a security failure; ii. purchase or upgrade of computer systems or software; iii. acquisition of new communications services; iv. introduction of new tools; v. introduction of new out-sourced processing vendor; and vi. discovery of a new threat or a change in a threat’s direction, scope or intent. Copyright MAMPU Chapter 3 - 3