Advanced Search
Search Results
285 total results found
Maintaining accountability
Controlling access to government software helps establish accountability for actions taken within the system. By assigning specific user accounts and permissions, agencies can track and audit user activity, making it easier to identify individuals responsible ...
Resource management
Government software resources, including licenses, computing resources, and data storage, are often limited and must be allocated efficiently. Controlling access helps ensure that resources are used effectively by restricting access to only those who truly nee...
Protecting Intellectual Property
Government software may contain proprietary algorithms, code, or technologies developed for specific government purposes. Some of the software may also be licensed with specific restrictions that should be complied with. Controlling access helps protect these ...
Intended purpose [Mandatory]
Government software should only be used for its intended purpose. Government software should not be used for personal gain, commercial purposes, or any illegal activities. Users should refrain from engaging in activities that could compromise the integrity or ...
Licensed software[Mandatory]
Licensed software should only be used in accordance with any license terms and conditions. Avoid violating the license terms and conditions, such as making or distributing unauthorized copies, modifying or reverse engineering the software, exceeding the numbe...
Intellectual property[Mandatory]
Software use should be respectful of the intellectual property rights of the software authors and publishers.
Software updates [Mandatory]
Software should be kept updated and secure. Each institution should establish guidelines for updating software and users informed of their role.
Reporting violations [Recommendation]
There should be a mechanism for reporting any software user violations to the appropriate authority within the institution. This should be included in training and awareness sessions for users.
Storage locations [Mandatory]
Government software and related data should only be installed and stored on Government provided devices or storage locations.
Security awareness [Mandatory]
Users should be made aware of software security risks and how to avoid behavior that exposes software to malware or other security risks such as recognizing phishing emails or clicking on links from unknown sources.
Central management [Recommendation]
Software installed in employee work devices should be centrally managed as much as possible to ensure it is obtained from legitimate sources, used within license terms and regularly updated.
Authorized access [Mandatory]
Only authorized users should be granted access to Government software applications. User access permissions should be based on a user's role and responsibilities in the institution.
Termination of user accounts [Mandatory]
User accounts should be terminated or disabled when a user leaves the institution. There should be a process to inform IT when an employee leaves the institution for their accounts to be removed or disabled. Regular audits should be performed to check for any ...
Third parties access[Mandatory]
Third parties should not be provided access to software in a production/live environment unless the access is required for them to perform an authorized service. Such access should be monitored and provided only for the period of time it is required.
Generic or shared user accounts[Mandatory]
User accounts should not be generic or shared but traceable to specific individuals for purposes of accountability.
Securing login credentials [Mandatory]
Users should be made aware to keep login credentials such as User IDs and Passwords confidential and not share them.
Password policies[Mandatory]
Appropriate password policies should be defined covering password expiration period, password complexity and allowed login attempts. Adoption of the NIST password policy guidelines is recommended.
Multi-Factor Authentication[Mandatory]
Multi-Factor Authentication (MFA) is strongly recommended as the primary authentication method for government institutions in Rwanda. It provides a high level of security by requiring users to present multiple independent factors for identity verification, sig...
Biometrics[Recommended]
Biometrics can be considered as an additional layer of authentication where it is available and where it is cost effective. Government institutions may explore the use of biometrics, such as fingerprint or facial recognition, for situations where high-security...
Entry into force
This guideline shall come into force on the date of its signature by the Chief Executive Officer of RISA.