Social Connect:
This requirement will provide an overall picture of the global health, safety and security measures implemented to protect and secure lives and properties as well as the system and its supporting infrastructure. The Assessor must establish that there is a documented procedure used in granting access to the premises, access to the system, managing rights, managing passwords and login credentials etc. There must be a full global health, safety and security audit in place to monitor who does what, where and at what time (date and time stamp).
The audit must include all health, safety and security breaches of intrusion, login failures, login success records etc. The measures must include data encryption policies and secure information transmission and communications protocols across the entire system. The plan must show a detailed description of the entire security controls, measures, tools, software, solutions, personnel and devices installed or implemented to protect and secure lives and properties as well as the system against attacks, unauthorized access, hacking etc. The Assessor must demand to see proof of these measures in place if implemented by the Service Provider and request for a copy of the documented security plan. Where this is not available, the Assessor must escalate to the next level.
The Assessor must find out if there is a documented procedure in place to frisk visitors as well as platform Users before they are admitted into the premises and to manage login credentials at the Mission or if it is centrally managed by the Service Provider. Are there rules in place on how often passwords should be changed? Is there Anti-virus software installed on each system running the visa application? The Assessor must be able to obtain answers to these questions. The Assessor must demand to see these procedures if in use at the Mission/Embassy page.
REPORT SYSTEMS SUPPORT
This requirement is to determine the report generation capability of the system from the end-user perspective. The ability of the end-user to generate specific and ad-hoc reports using different parameters is key to measuring the overall suitability of the system. The system must give end-users options of pre-configuring the type of reports they want to generate based on their specific needs. The Assessor must determine whether or not the system-generated reports meet the requirements of the end-user.
It is also necessary to determine whether or not the user is able to create his report independent of the Service Provider. Other question that Assessor must ask: Does the system have automatic report generation template? The Assessor must see sample reports generated by the system as proof. However, for security reasons, the Assessor may not take the reports out of the premises.
4.1. BACKEND ARCHITECTURE
This requirement is necessary for the Assessor to document the speed of communication protocol, system scalability, performance record of security and privacy features and service discovery.
This requirement is to ascertain that the Service Provider has a process in place to maintain the equipment – hardware and infrastructure supporting the entire platform. The Assessor must demand to know how equipment preventive maintenance has been scheduled, whether it is meter-driven or date-driven. If the curative maintenance has occurred, the Assessor must determine the level of participation of Service
Providers staff or external craft. Documentation of replacement components used during maintenance is essential to determine the point at which to request for equipment replacement. The Service Provider must present an overall picture of how equipment is managed across the missions, data centers and VACs. This plan must also include Equipment Maintenance Service Level Agreement with the OEM or any other sub-contractor who may have been engaged by the OEM to perform the function. The Plan must demand and see the equipment maintenance records, how they are kept or will be kept including replacement components availability record. For breakdown or curative maintenance, a record of trigger, authorization and response mechanism must be established and documented.
5.1. PREVENTIVE MAINTENANCE
This requirement is to establish if Service Level Agreement exists between the OEM and the Service Provider. The Assessor must request to see if such exists. Where such does not exist, the Assessor should demand to know how equipment or software installed at VAC is currently being supported technically; routine service or on-demand service. Assessor must demand to see a copy if available.
This requirement is to provide a clear picture of the data center(s), components, conditions and location(s). The documentation will include a full description of the data center architecture, the installed storage capacity, current storage capacity usage, the server clusters etc. It will show a documentation of the backup power supplies, redundant data communications connections, the environmental controls such as air-conditioning, safety appliances and other virtual and physical security controls and devices put in place to protect the data center from damage, fire, flooding, explosion, unauthorized access etc. The Assessor must demand to see a copy of this documentation, if available.
6.1. SERVICE PROVIDER’S UPDATE OR UPGRADE SYSTEM DOCUMENTATION
This requirement is to ascertain that the Service Provider has a process in place to manage documentation on every update and upgrade done on the system. This requirement is to ascertain if any updates and upgrades have been carried out on the system and how these were approved and carried out. The documentation must show user acceptance and sign-off as well as input from Project Consultant. The document must clearly show why the update or upgrade was/is necessary and the new features to be contained in the update or upgrade.
The need for updates or upgrades may be user-initiated or service provider initiated. Where it is user-initiated, the change request process must be well documented and when it is service provider initiated, the user and project consultant must be duly informed of the updates and necessary approval must be granted. If no update or upgrade has been done as at the time of conducting assessment, the Assessor must demand to see a template of how the Service Provider intends to keep records of updates and upgrades as well as obtain approval for such.
6.2. BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN
The requirement is to determine if the Platform has its own back-up and disaster recovery plan in place when there is power, network or system failure to prevent downtime and whether there is any designated official who can operate or activate the plan. The requirement also involves ascertaining that there are data back-up procedures in place. The Assessor must demand to see the back-up plan and must also request the frequency of data back-up if done by the end-user. The Assessor must establish who performs data back-up (embassy officials or service provider) and how it is performed (manually or automatically; on-site or remotely). This requirement will show clearly how this critical component is being handled; centralised or decentralised.
The summary of the important intervention to determine the overall plan put in place by the Service Provider to ensure minimal or no downtime and guarantee system availability 24/7. The plan must contain a detailed description of the methods, strategies, tools, hardware, solutions that has been implemented to mitigate against denial of service attacks, cyber-attacks etc. The plan must document redundancy plan, primary and secondary data centers etc. The plan will show clearly how the system will recover from power failure, network failure or hardware failure. The plan must also include how data is replicated and protected, how data is stored, frequency of data back-ups etc.
MISSION VISA APPLICATION SYSTEM SUPPORT
This requirement is to determine if there is a process in place for managing and attending to incidents at the Mission. The Assessor must see a documented plan or process for addressing incidents including escalation procedure and list of primary and secondary personnel to contact when there are minor issues with the visa application system and its supporting infrastructure.
The Assessor must find out if there have been occurrences of downtime or denial of service attacks (periods when end-users are not able to use the system), if such problems were documented and how they were addressed. What are the channels of communication with the Service Provider when issues arise and how fast are such problems resolved? Just like the case of disaster recovery, is there an Incident Response Plan that provides details of how to manage these minor crises/issues when they occur? The Assessor must demand a copy of the plan if available and check its effectiveness in addressing issues when they arise.
NeGSt was created in March 2004 and mandated by the Federal Government of Nigeria to operate, drive and implement the Nigerian eGovernment programs under a Private Public Partnership model.
By submitting this form, you consent to receive updates from National eGovernance Strategies.
NeGSt – TAS TECHNOLOGIES LTD is committed to protecting the privacy of our customers and users of this site, and endeavours to provide a safe customer and user experience. This privacy policy describes how your personal information is collected, used, shared, and secured (processed) and your choices regarding the use, access, and correction of your personal information.
