ANALYSIS OF THE FINDINGS Organisation Proiles

4. ANALYSIS OF THE FINDINGS Organisation Proiles

Organisation proiles were obtained through the individual key players representing it. The analysis of the proiles is relevant to the indings in terms of providing the organisational information that the respondents represent. The organisations are characterised by four attributes; the type of organisation in terms of government administrative structure, the Organisation proiles were obtained through the individual key players representing it. The analysis of the proiles is relevant to the indings in terms of providing the organisational information that the respondents represent. The organisations are characterised by four attributes; the type of organisation in terms of government administrative structure, the

CELLENCE

and whether the organisation’s core business relies on ICT for its successful operation. Figure 1 depicts the proportion of organisations surveyed. As indicated in Figure 2 the percentage of survey returned according to organisation types are about even for

Journal EX

Federal Government Agencies, Ministries, and Departments. However, the percentage of response from State Government Oices and Statutory Bodies are lower. One factor could be due to the fact that the majority of the agencies listed in the sampling frame given by MAMPU are the central agencies, ministries and departments. These are the organisations given focus by MAMPU in many information security programmes. This is because the implementation of many critical functions and active information systems of the Malaysian Public Service are largely concentrated in these organisations. The responses of the key players from all the organisations surveyed are signiicant because the indings indicate that as a whole seventy-three percent of them are dependent on ICT for running the core business (see Figure 2) hence the issues of information security are very much relevant to them.

State Government

Statutory Bodies

Ministries 13% (n=20)

Federal Government Central Agencies 17%

Figure 1: Types of Organisations in Malaysian Public Service (MPS) Represented in the Survey

Years

Core Business is non ICT Dependent (overall 27%) Core Business is ICT Dependent (overall 73%)

Figure 2: Organisations’ Dependence on ICT and Years of Implementation

Volume 1

Information Security Maturity Level

Number 1

An often quoted management philosophy “if you cannot measure it you cannot manage it” is also applicable to information security. In this study, the measurement is through the information security maturity level. An organisation’s information security maturity level is a measurement of the organisation’s capability to remain secure (Siponen, 2002).

Hence, in order to assess MPS organisations’ information security maturity levels, the study incorporated into the survey questionnaire some key processes as measurement indicators.Conversion of information security maturity continuous scale to categorical scale - consisting of six categories- was carried out in order to compute information security maturity. This was done by irst getting the summated score of the responses to the forty-ive items measuring information security maturity. The total sum was split into six equal groups representing level 0 to level 5.This is followed by the computation of the responses and determination of the proportion of each level (Malhotra, N. K., 2004).

Figure 3 exhibits the information security maturity level of organisations in the Malaysian Public Service in general. Sixty-one percent of the organisations are at Level 3. It appears that based on respondents’ observation and knowledge of the management practices in their own organisations, the majority of them believe that the information security management practices are still well-documented and have been communicated throughout the organisations. Next, twenty-one percent of the organisations are at Level 2 where the information security processes are still considered an ICT domain. At the higher end of the continuum lies thirteen percent at Level 4 and one percent at Level 5.

For a more detailed perspective, Figure 4 shows types of organisations which were considered to have higher information security maturity levels. One noticeable fact is that Statutory Bodies seemed to cluster along Levels 3 to 5. In that sense, they are ahead of the other organisation types. Federal Government Central Agencies, Government Departments and State Departments mostly hover in the range of Levels 2 to 4. Interestingly enough, ministries seem to lag a bit as most of them are in Levels 0 to 3.

Figure 3: Information Security Maturity Levels of MPS Organisations

Legend:

CELLENCE

a Level

Meaning