Digital Adoption Implementation Guidelines for Government of Rwanda
This document serves as a guide to support the government of Rwanda institutions herein referred to as public institutions and affiliated institutions during digitalization implementation and application to ensure consistency in terms of security, reliability, scalability, effectiveness and efficiency in service delivery.
Introduction
This document serves as a guide to support the government of Rwanda institutions herein referred ...
Objectives
These guidelines aim at providing a uniform framework for the design, configuration, and manageme...
Benefits
Adoption of these guidelines will allow government institutions to: Have a high quality and re...
Scope
These guidelines shall be strictly adhered to by all government institutions, including instituti...
Principles
These digitalization implementation guidelines shall be used as best practices for digitalizati...
Network and Communication Infrastructure
This section provides guidelines and requirements for deployment of IT networks across institutio...
Network design
The following parameters shall be based on while designing institution network: Number of use...
Network Implementation
Network equipment: The network equipment and devices comprising the core network infrastructur...
Network Management
Network performance: Redundancy, load balancing, application response time, and quality of serv...
Hardware & End-User Equipment
User devices
Institutional devices used by employees shall be labeled (tagged), recorded and proper naming sha...
Precaution measures
Offices with digitalization equipment shall be locked to prevent theft and other risks. Digita...
Stolen computers
In case of a stolen computer, the user shall immediately report to the supervisor and to Rwanda i...
User responsibilities
Users shall ensure proper use of digitalization equipment in accordance with all provisions of ...
Hardware acquisition, maintenance
All IT equipment shall be checked once in every quarter and maintained according to the elaborate...
Hardware disposal
Following the institution’s disposal committee resolutions regarding digitalization equipment to ...
Software Applications and Data
This section provides high level guidelines for software applications development, acquiring, usa...
Software applications
Architectural model for e-government applications: All systems shall be documented in five view...
Data
Data produced or collected by government institutions is necessary for measuring effectiveness an...
Business Continuity (BC) and Disaster Recovery (DR)
Business continuity management is a planning and holistic management through which institutions c...
System Administration
System administration is a core function in digitalization implementation, it involves a range of...
User collaboration and email service
All Public institutions are obliged to encourage and make sure that all employees own official ...
Password Policy
The following are minimum requirements to create as well as protecting password: The length of...
Email Accounts
All employees shall use corporate emails for any official communication. Email accounts belong...
System access and authorization
All corporate computers shall be joined to the Active Directory-Domain Controller for proper ma...
Cyber Security
Security Policy and Procedures
The public institution shall as a minimum have a documented Information Security Policy (ISP) bas...
Minimizing the exposure of systems to External Networks
Install and configure gateway firewall. Configure inbound and outbound Access Control List (AC...
Access Control
The institution shall limit system access to authorized users, processes acting on behalf of au...
Implement network segmentation
Access control: It shall start with IT assets, data, and personnel classification into specific...
Institution awareness and Training
The institution shall ensure that executives, senior management, managers, systems administrators...
Audit and Accountability
The institution shall create and retain system audit logs and records to the extent needed to ena...
Configuration Management
The institution shall establish and maintain baseline configurations and inventories of instituti...
Identity Management and Authentication
The institution shall identify system users, processes acting on behalf of users, and devices. ...
Incident Response
The institution shall have an operational incident-handling capability for institutional systems,...
Maintenance
The institution shall perform maintenance on institutional digitalization systems. The institu...
Media Protection
The institution shall protect (i.e., physically control and securely store) system media contai...
Personnel Security
The public institution shall identify (inventories) its own human resources. For each official ...
Physical and Environmental Protection
The institution shall divide the area it manages into security zones based on risk assessment t...
Risk Assessment
The institution shall periodically (at least once a year) assess the risk to institutional operat...
System and Communications Protection
The institution shall monitor, control, and protect communications (i.e., information transmitt...
System and Information Integrity
The institution shall identify, report, and correct system security flaws on time. The institu...
Personally identifiable information (PII) Processing and Transparency
The institution shall identify and meet the requirements for preserving privacy and protecting PI...
Contingency Planning
The institution shall ensure that backup copies of data, software and system images are regular...
Supply Chain Risk Management
In collaboration with a competent authority where applicable, the institution shall establish a...
Passwords Protection
Users shall have different passwords for different accounts. All default passwords shall be ch...
Sector Digital Strategic Plan
All sectors are required to develop sector digital strategic plans to guide the sector’s digital ...
Assessment of the current situationge
The development of a digitalization strategic plan shall be initiated by the mapping of a secto...
Definition of the strategic target position
The desired situation and attainable targets shall be defined within a period of 3-5 years. The t...
Definition of gaps
Based on the assessed current situation, a gap matrix shall be developed to highlight shortages i...
Establishing a roadmap to close the gaps.
This stage shall highlight the following: Highlight Strategic interventions that bring about t...
Roles and responsibilities
The success of the sector digitalization strategic plan depends on the endorsement, commitment, a...
Resources and Impact
Resources (human and financial) needed to implement the strategy and potential sources of funds w...
Digitalization Project Management
Digitalization project initiation
All digitalization projects shall be derived from the assessment as indicated in the above sectio...
Digitalization project documentation
Proper documentations of all digitalization projects across the government shall include the back...
Digitalization project implementation
The agile mode of implementation which allows visibility of project details and ability to manage...
Digitalization Office Function, Staffing and Training
Innovation and Creativity
All public institutions are called upon to embrace innovation and to adopt new ideas. This secti...
Challenge Definition
This stage describes the role of ideation within innovation processes, providing the designers wi...
Ideation Stage
After problem definition is ideation where the innovator shall learn as much as possible about a ...
Prototyping
Building prototypes make ideas and proposed solutions tangible and perceptible. Prototypes shall ...
Testing Stage
The testing shall be conducted on potential users as a way to get feedback on the prototype but a...
Implementation
A successful prototype will then be assessed for full development and implementation. This may le...
Consequences of Non-Compliance
Compliance to these guidelines is highly encouraged at all sector and institutional levels in ord...
Document Review Cycle
RISA and stakeholders shall review these guidelines every three years or when deemed necessary to...
References
Minimum Bandwidth for Broadband Internet Connectivity in Rwanda Directives on Cyber Security...