Success Story: Iraqi Ministries Work Together to
Coordinate Information Security and Management
USAID economic advisors help GOI achieve breakthrough in information security
March, 2007
As part of the USAID-funded Economic Governance II Project to assist in economic reconstruction and policy reform in Iraq, USAID is working with the Government of Iraq (GOI) to improve information security for sensitive public and private information.
Over the course of the six-month plan, USAID’s eGovernment Services (eGS) advisors, together with IT staff from GOI ministries, will implement an information security system based on international standards, creating uniformity in the way that sensitive data is managed across various Iraqi ministries.
Under the Saddam regime, ministries received instructions from non-ministry personnel working directly for senior regime loyalists. Instructions were often disordered and procedures inconsistent.
The eGS project addresses the ministries’ lack of standardized systems and processes, as well as the difficulties that they face in trying to securely gather, analyze, disseminate and store public and private information so that services can be provisioned efficiently.
The new information security system enlists ISO 17799, a global standard for information security management used by more than 3,300 governmental entities and commercial organizations in 68 countries.
To ensure consistency, USAID is working with ministry IT directors to identify criteria that are functionally equivalent from ministry to ministry and that can be used to develop high-level policies for securing the confidentiality, availability and integrity of ministerial information.
Four GOI ministries – the Central Bank of Iraq, Ministry of Finance, Ministry of Foreign Affairs and the Ministry of Science and Technology – are on track to implement the first cross-ministry policies for information security management. The policies cover the following areas:
- Information security management plan
- Documented roles and responsibilities for all IT personnel
- Acceptable use policy for email and Internet access
- Information security classification categories and levels
Scheduled to run through August 2007, the program provides an aggressive timeline for the completion of a set of 11 information security risk self-assessments by each ministry.
The project also calls for the creation of cross-ministry documentation and ministry-specific risk treatment plans, procedures and detailed work instructions for specific critical processes and systems.
As part of the project, USAID advisors will focus on capacity-building in information security awareness and on related trainings for all ministry staff and for senior managers.
View print-friendly version of this success story (PDF, 51kb)
Back to Top ^
|
