IT Governance Standard-Second Edition.

GOVERNMENT ICT STANDARD ICTA.5.
002:2019
Part 5
IT Governance Standard (ICTA. 5.002.2019)
© ICTA 2019- All rights reserved Second Edition 2019
The ICT Authority is a State Corporation under the State Corporations Act 446
www.icta.go.ke
1
GOVERNMENT ICT STANDARD ICTA.5.002:2019
REVISION OF ICT STANDARDS
In order to keep abreast of progress in industry, ICT Standards shall be regularly reviewed. Suggestions
for improvements to published standards, addressed to the Chief Executive Officer, ICT Authority, are
welcome.
©ICT Authority 2019
Copyright. Users are reminded that by virtue of Section 25 of the Copyright Act, Cap. 12 of 2001 of
the Laws of Kenya, copyright subsists in all ICT Standards and except as provided under Section 26 of
this Act, no Standard produced by ICTA may be reproduced, stored in a retrieval system in any form or
transmitted by any means without prior permission in writing from the Chief Executive Officer.
ICT AUTHORITY (ICTA)
Telposta Towers 12th floor. Kenyatta Avenue P.O. Box 27150-00200, Nairobi Kenya Tel.: +254 20
2211960/61
Web:http://www.icta.go.ke
Email:standards@ict.go.ke
2
DOCUMENT CONTROL
Document Name Government IT Governance Standard
Prepared by: Government IT Governance Technical Committee
Edition Second Edition
Approved by Board of Directors
Date Approved
Effective Date
Next Review Date After 3 years
3
Table of Contents
................................................................................................................ 1
1. Introduction ............................................................................................ 7
1.1 Description of standard ........................................................................ 9
2. Scope ................................................................................................... 9
Application .................................................................................................. 9
3. Normative references ................................................................................ 9
4. Terms and Definitions ............................................................................... 10
5 Enterprise Architecture ................................................................................ 11
5.1. Business Architecture .......................................................................... 11
5.3 Information Architecture ....................................................................... 11
5.4 Infrastructure Architecture .................................................................... 11
6.0 ICT Governance..................................................................................... 12
6.1 Independent ICT Function ...................................................................... 12
6.2 ICT Governance Committees................................................................... 12
6.3 ICT Organization ................................................................................. 12
6.4 IT strategy ........................................................................................ 12
6.5 IT Project governance .......................................................................... 12
7 IT Service Management ................................................................................. 13
7.1 IT Service Strategy ................................................................................. 13
7.1.2 IT Service management ...................................................................... 13
7.2 Service level management ........................................................................ 13
7.2.1 Service desk.................................................................................... 13
7.2.2 IT Operations Control......................................................................... 13
7.2.3 Business Relationship Management ......................................................... 13
7.3 IT Service Design ................................................................................... 13
7.3.1 Availability Management ..................................................................... 13
7.3.2 IT Infrastructure Capacity Management ................................................... 14
7.3.3 Information Security Management .......................................................... 14
7.3. 4Supplier management ........................................................................ 14
7.4 IT Service transition ............................................................................... 14
7.4.1 IT Service change management ............................................................. 14
7.4.2 Knowledge management ..................................................................... 14
4
7.5IT Continuous service improvement .............................................................. 14

7.5.1 Service and process performance review.................................................. 14
8 Legal and Regulatory ................................................................................... 14
8.1 Kenya laws on ICT .................................................................................. 14
8.2 Roles and responsibilities ......................................................................... 15
9 ICT Risk management ................................................................................... 15
9.1 General .............................................................................................. 15
9.2ICT Risk framework ................................................................................. 15
10 Sourcing, Resourcing and Financing of IT functions .............................................. 15
10.1 General ............................................................................................. 15
10.2 Sourcing of ICT equipment, products and services .......................................... 15
10.3 Resourcing ......................................................................................... 15
10. 4 Financing .......................................................................................... 16
10.5 Asset management ............................................................................... 16
10.6 Capacity building ................................................................................. 16
10. 7 Tools ............................................................................................... 16
10.8Innovation .......................................................................................... 16
Appendix1: Compliance Checklist for Enterprise Architecture ..................................... 16
Appendix 2: Compliance Checklist for ICT Governance .............................................. 18
6.2 ICT Governance Committees................................................................... 18
6.3 ICT Organization ................................................................................. 18
6.4 IT strategy ........................................................................................ 18
6.5 IT Project governance .......................................................................... 19
Appendix 3: Compliance Checklist for IT Legal and regulatory ..................................... 19
8.1 Kenya laws on ICT .............................................................................. 20
8.2 Roles and responsibilities ......................................................................... 20
Appendix 4 Compliance Checklist for IT Service Management ...................................... 21
Appendix 5 Compliance Checklist for ICT and Risk Management ................................ 23
Appendix6 IT Project Management ................................................................ 24
Appendix7 Performance management ............................................................ 25
Appendix 8 Risk management ...................................................................... 25
Appendix 9 ............................................................................................ 27
IT GOVERNING COMMITTEES ........................................................................ 27
Appendix10 Guidelines for Sourcing ................................................................. 28
5
Appendix 11GoK Project Management Governance Structure.................................... 30

Appendix 12: ICT Organization Structures .......................................................... 31
Appendix13: Project governance roles .............................................................. 33
Appendix 14: Project management documentation ............................................... 39
Appendix 16: Project documentation development ............................................... 41
Appendix 17: A generic project governance model for larger, more complex projects ...... 42
Appendix 18: Sample Outcome Realization data for the Project Business Plan ............... 43
Appendix 19: Stakeholder engagement process .................................................... 43
Appendix 20: Stakeholder engagement process .................................................... 44
Appendix 21: Elements of the risk management process ......................................... 45
Appendix 22: Risk matrix for grading risks .......................................................... 46
Appendix 23: Recommended actions for grades of risk ........................................... 47
Appendix 24: Issue management flowchart ......................................................... 48
Appendix 25 Sample Project Issues Register ........................................................ 49
Appendix 26: Project closure ......................................................................... 50
Appendix 27: Sample Service Management structure (ITIL) for Small organizations .......... 51
Appendix 28: Sample Service Management structure (ITIL) for large organizations .......... 52
Appendix 29: Service desk 1st, level, 2nd level and 3rd level support definitions ........... 53
APPENDIX 30: SAMPLE ICT STRATEGY FORMAT ..................................................... 54
APPENDIX 31: Who needs to be involved in Legal contracts ........................................ 65
Appendix 32: Risk management process ............................................................... 67
Appendix 33: Accreditation of ICT Service Providers ................................................ 67
Appendix 35: Government ICT Project Governance Structures ..................................... 77
Appendix 36 Audit for outsourced applications ....................................................... 79
FOREWORD
The ICT Authority has the express mandate to, among others, set and enforce ICT standards and
guidelines across all aspects of information and communication technology including systems,
infrastructure, processes, human resources and technology for the public service. The overall purpose
6
of this specific mandate is to ensure coherence and unified approach to acquisition, deployment,
management, and operation of ICTs across the public service, including state agencies, in order to
promote service integration, adaptability and cost savings through economies of scales in ICT
investments.
In pursuit of the achievement of this mandate, the Authority established a standards committee that
identified the critical standards domain areas and oversaw the standards development process. To this
end, the committee consulted and researched broadly among subject matter experts to ensure
conformity to acceptable international and national industry best practices as well as relevance to the
Kenyan public service context. The committee eventually adopted the Kenya Bureau of Standards
(KEBS) format and procedure for standards development. In addition, through an MOU, KEBS has made
an invaluable contribution to the development of ICT Authority standards.
The ICTA IT Governance Standard,which falls under the overall Government Enterprise Architecture
(GEA), has therefore been prepared in accordance with KEBS standards development guidelines which
are, in turn, based on the international best practices by standards development organizations
including ISO.
The Authority’s Directorate of Programmes and Standards has the oversight role and responsibility for
management, enforcement, and review of this standard. The Directorate shall be carrying out
quarterly audits in all the Ministries, Counties, and Agencies (MCDA) to determine compliance to this
Standard by the agencies.
The Authority shall issue a certificate for compliance to agencies upon inspection and assessment of
the level of compliance to the standard. For non-compliant agencies, a report detailing the extent of
the deviation and the prevailing circumstances shall be tabled before the Standards Review Board who
shall advise and make recommendations.
The ICT Authority management, cognizant of the central and core role that standards play in public
service integration, fostering shared services and increasing value in ICT investments, takes great
exception to the enforcement of this standard by all Government agencies. The Authority, therefore,
implores agencies to prioritize the process of certification to this standard as a foundation of their ICT
investments in order to create and enhance value.
Paul Kiprono Rono,

Director, Programmes and Standards,
ICT Authority
1. Introduction
IT Governance is part of the wider Corporate Governance activity but with a specific focus to IT. IT
Governance covers the culture, organization, policies, and practices that provide oversight and
transparency of IT. For organizational investment in IT to deliver full value, IT has to be fully aligned to
7
organizational strategies. The benefits of good IT risk management, oversight, and clear
communication not only reduce the cost and damage caused by IT failures – but also engenders greater
trust, teamwork, and confidence in the use of IT itself and the people trusted with IT services.
The biggest risk and concern to the government today is failing to align IT to real business needs, and a
failure to deliver or be seen to be delivering, value to the business. Since IT can have such a dramatic
effect on MCDA performance and competitiveness, a failure to manage IT effectively can have a very
serious impact on the organization as a whole.
The current climate of cost reduction and budget restriction has resulted in new norms – there is an
expectation that IT resources should always be used as efficiently as possible and that steps are taken
to organize these IT resources ready for the next cycle of growth and new IT developments. A key
aspect of these factors is the increasing use of third-party service providers and the need to manage
these suppliers properly to avoid costly and damaging service failures.
In addition, IT governance recognizes the critical role IT functions play in an organization and the need
to place it at par with other core functions in terms of reporting lines.
IT governance shall assist MCDAs to:
 Create deeper understanding and awareness of all IT related risks likely to have an impact on
their organization;
 Know how to improve the management processes within IT to manage these risks;
 Ensure there are manageable relationships with suppliers, service providers and with the
business customers;
 Contract and managed IT suppliers with expected level of performance
 Ensure there is transparent and understandable communication of these IT activities and
management processes to satisfy interested stakeholders.
 Recruit and maintain IT Professionals who are competent and regulated.
IT Governance is not a one-time exercise or something achieved by a mandate or set of rules. It

requires a commitment from top management of the organization to instill a better way of dealing with
the management and control of IT. IT Governance is an ongoing activity that requires a continuous
improvement mentality and responsiveness to the fast-changing IT environment.
IT governance shall result in:
a. Transparency and accountability
- Improved transparency of IT costs, IT process, IT portfolio (projects and services).
- Clarified decision-making accountabilities and definition of user and provider relationships.
b. Return on investment
- Improved understanding of overall IT costs and their input to ROI cases.
- Combining focused cost-cutting with an ability to reason for investment.
- Stakeholders allowed seeing IT risk/returns.
c. Opportunities and Partnerships
- Provide a route to realize opportunities that might not receive attention or sponsorship.
- Positioning of IT as a business partner (and clarifying what sort of business partner IT is).
- Facilitate joint ventures with other organizations.
- Facilitate more business-like relationships with key IT partners (vendors and suppliers).
- Achieve a consistent approach to taking risks.
- Enables IT participation in organization strategy (which is then reflected in IT strategy) and
vice versa.
- Improve responsiveness to challenges and opportunities.
d. External Compliance
- Enables an integrated approach to meeting government legal and regulatory requirements.
8
1.1 Description of standard
IT governance is defined as the processes that ensure effective and efficient use of IT in enabling an
organization to achieve its goals.
2. Scope
IT governance consists of the leadership and organizational structures and processes that ensure
the enterprise sustains and extends strategies and objectives. It spans the culture, organization,
policy, and practices that provide for IT management and control across five key areas:
 Alignment – Provide for strategic direction of IT and the alignment of IT and the business with
respect to services and projects.
 Value delivery – Confirm that the IT/Business organization is designed to drive maximum
business value from IT. Oversee the delivery of value by IT to the business, and assessment of
ROI.
 Risk Management– Ascertain that processes are in place to ensure that risks have been
adequately managed. This includesthe assessment of the risk aspects of IT investments.
 Resource management – Provide high-level direction for sourcing and use of IT resources.
Oversee the aggregate funding of IT at the enterprise level. Ensure there is adequate IT
capability and infrastructure to support current and expected future business requirements.
Ensure competent human resource with desired ethical behaviors and norms.
 Performance – Verify strategic compliance, i.e. achievement of strategic IT objectives. Review
the measurement of IT performance and the contribution of IT to the business (i.e. delivery of
promised business value). Ensure that IT service providers are regulated and managed so as to
maintain expected level of performance in delivery of their services to government.
Application
This standard applies to:
 Central Government of Kenya
 County Governments
 Constitutional Commissions
 State Corporations
 Government Institutions
3. Normative references
The following standards contain provisions which, through reference in this text, constitute provisions
of this standard. All standards are subject to revision and, since any reference to a standard is deemed
to be a reference to the latest edition of that standard, parties to agreements based on this standard
are encouraged to take steps to ensure the use of the most recent editions of the standards indicated
below. Information on currently valid national and international standards can be obtained from the
Kenya Bureau of Standards.
 COBIT 5
 PRINCE2
 ITIL V4
 CISA Review Manual 27th edition
 Government Enterprise Architecture
Managers of projects dealing with software products or software-intensive systems may find the
contents of the PMBOK®6 Guide and ISO 10006:2018 helpful, in managing their projects to a successful
conclusion.
9
4. Terms and Definitions

4.1Enterprise Architecture
Enterprise architecture (EA) is a conceptual blueprint that defines the structure and operation of ICTin
an organization. EA involves documenting an organization’s IT assets in a structured manner to
facilitate understanding, management, and planning for IT investments. An EA often involves both a
current state and an optimized future-state representation (e.g., a road map).
4.2 Enterprise IT Governance
EGIT is about the stewardship of IT resources on behalf of all stakeholders (internal and external) who
expect their interests to be met. Management, processes, operational governance structure of the
enterprise ICT.
4.3 Service desk
A Service Desk is a primary IT function within the discipline of IT service management. It is intended to
provide a Single Point of Contact to meet the communication needs of both users and IT staff.
4.4. Abbreviations
4.1 EA Enterprise Architecture
6.2 WAN Wide Area Network
6.3 LAN Local Area Network
6.4 SLA Service Level Agreement
6.5 MCDA Ministry, County, and agency
6.6 ICTA ICT Authority
6.7 ROI Return on Investment
6.8 NEMA National Environment Management Authority
6.9 CIO Chief Information Officer
6.10 QOS Quality of Service
6.11 COBIT Control Objectives for IT
6.12 PMBOK Project Management Book
6.13 SWOT Strength Weakness Opportunity and Threat
6.14 CMMI Capability Maturity Model Integration
6.15 COSO Committee of Sponsoring Organizations
6.16 PPP Public-Private Partnership
6.17 GEA Government Enterprise Architecture
6.18 CISO Chief Information Security Officer
6.19 IT Information Technology
10
5Enterprise Architecture
a) MCDAs shall develop an Enterprise architecture as a conceptual blueprint that defines the structure
and operation of ICT in an organization
b) MCDAs shall be guided by the approved Government Enterprise Architecture when developing their
enterprise Architecture based on appropriate business, application, information, and infrastructure,
security, performance, and project governance architecture to support the entire ecosystem
5.1. Business Architecture
5.1.1 Business plans and objectives

a) MCDAs shall adopt principles of their specific business architecture in line with the
Government Enterprise Architecture.
b) MCDAs shall have clearly defined ICT plans, objectives and metrics that support
business goals
c) MCDAs shall have mechanisms for monitoring the performance of ICT investments.
5.1.2 Business Process

a) MCDAs shall have business processes designed and applied to focus on service to Citizens
provided as a single interface through multiple access platforms
b) MCDAs will seek to optimize business processes and then use performance standards to
define automation requirements
5.2 Application Architecture
a. MCDAs shall ensure the design; implementation and delivery of the application
architecture shall adhere to the application architecture principles as guided by
GEA.
5.3Information/data Architecture
a) MCDAs shall adopt appropriate analytical services for discovery interpretation of meaningful
data patterns
b) MCDAs shall implement master data management to define and manage their critical data
with integration and a single point of reference.
5.4InfrastructureArchitecture
a. MCDAs shall ensure the design, implementation, and delivery of the infrastructure
architecture shall adhere to the infrastructure architecture principles as guided by
GEA. The principles are:-
i) Ensuring technology diversity is contained
ii) Technology components are able to interoperate and exchange
information
b. The MCDAs shall implement LAN/WAN, internet, computing, enterprise networks,
storage, and data center to support business operations in line with the GEA and
Infrastructure Standard
5.5 Security and Compliance

a) MCDAs shall ensure the design, implementation, and delivery of information security shall
adhere to the information security architecture principles as guided in the GEA
b) MCDAs shall establish information security governance structure as guided by appendix 9 b
5.6 Project Management and Governance Architecture

a) MCDAs shall ensure the design, implementation, and delivery of ICT projects shall adhere
to the project management and governance architecture principles as defined in the GEA
11
5.7 Performance Architecture
5.7.1 Capability Maturity Model Integration (CMMI)

a) MCDAs shall improve business goals or develop process guidance models that
provide a clear definition to promote improved performance.
5.7.2 Balanced Scorecard

b) MCDAs shall have an ICT Balanced Scorecard to measure performance consisting of
four perspectives: IT Value, User, Operational Excellence, and Future Orientation
6.0 ICT Governance

6.1 Independent ICT Function
a) MCDAs shall have a defined structure for the ICT function in the organization reporting to
the Accounting Officer or the Chief Executive Officer(CEO).
6.2 ICT Governance Committees
MCDAs shall establish two ICT governance committees;
a) An IT Strategy committee to provide strategic advice on ICT initiatives and investments

to the board as defined in Appendix 9.
b) An IT Steering Committee to define the IT mission and goals aligned with the strategic
direction of the organization; authorize and direct the development of the services and
operation plans as defined in Appendix 9
6.3 ICT Organization
a) MCDAs shall establish an ICT organization structure that adequately responds to the
business goals, mandate, and vision of the organization.
b) The head of the ICT function shall report to the accounting officer and shall holdeither
the following titles
i. Chief Information Officer (CIO)
ii. Chief Information Technology Officer (CITO)
iii. Chief Technology Officer (CTO)
iv. Director ICT (DICT) or Head of IT(HIT)
6.4 IT strategy
a) IT shall be a strategic objective in the overall strategic plan of the MCDAs.
b) The MCDAs shall prepare and maintain an ICT strategic plan witha clear IT vision and
mission that defines how the MCDAs plan to improve internal services and services to
businesses and citizens.
c) The strategy shall be developed with input from internal and external stakeholders.
d) The strategy shall be informed by a situational analysis of the internal and external
businessenvironment
e) The strategy shall define specific tasks and responsibilities for achieving value delivery
from ICT investment
f) The strategy shall be implemented to achieve ICT optimized investment
6.5 IT Project governance
a) MCDAs shall establish a Project Management Office.
b) Projectsshall be based on clear and compelling concept and business case.
c) A projectcharter shall be prepared for all projects.
d) A project implementation committee shall be created to report to the IT
steeringcommittee and shall be led by a project manager.
e) MCDAs shall adopt and approve a project's implementation methodologybasedon
globally accepted approaches such as PMBOKorPrince 2.
12
f) MCDAs shall adopt software development methodologies that include waterfall, agile,
SDLC and SCRUM. as guided by the Systems and Applications standard
g) MCDAs shall carry out their project management as guided inAppendix 11-19.
7IT Service Management

7.1IT Service Strategy
a) MCDAs shall develop an IT service strategy to create new and improved services.
7.1.2 IT Service management

a) MCDAs shall have a service charter for IT enabled services.
b) The charter shall define the desired outcomes of the services.
c) The charter shall define the assets required to offer the services.
d) MCDAs shall annually evaluate usage of the IT enabled services and customer satisfaction.
7.2 Service level management

a) MCDAs shall develop and sign service level agreement (SLA) with service providers (internet,
systems support, maintenance, etc.) to ensure the availability and reliability of IT enabled
services.
b) The SLA shall define performance metrics for the service providers.
c) MCDAs shall monitor achievement of service levels and compare them with agreed service
targets in the SLA
d) SLAs shall have penalties for failure to meet agreed service levels
7.2.1 Service desk
a) MCDAs shall establish an IT service desk management system to handle all requests from
end-users
b) The service desk shall have 1stlevel, 2nd level, and 3rd level support
c) The service desk shall develop and document standard operatingprocedures for IT services
d) MCDAs shall have a system to track customer complaints, compliments, and resolution
7.2.2 IT Operations Control

a) MCDAs shall designate staff to manage the day to day operational activities in IT e.g. back
up, routine maintenance, print and output management, installations to ensure they are
done in a reliable and timely manner
b) MCDAs should manage fraud usingthe COSO framework
c) MCDAs should adopt IT service and governance framework such as COBIT for internal
controls and management of IT
7.2.3 Business Relationship Management

a) MCDA shall conduct and document customer satisfaction surveys on IT enabled services
annually for internal and external customers
b) MCDA shall conduct training and awareness programs annually to sensitize internal and
external customers on IT enabled services
7.3 IT Service Design

7.3.1 Availability Management
a) MCDAs shall develop and implement quarterly preventive maintenance plans for IT
equipment
b) MCDAs shall develop and maintain manuals on how to operate and maintain systems and
equipment
c) MCDAs shall develop a disaster recovery plan for all services
13
7.3.2 IT Infrastructure Capacity Management

a) MCDAs shall annually evaluate the capacity of IT infrastructure to understand the current
environment and plan for future needs. The ICT Authority shall validate such evaluation
b) MCDAs shall establish a framework for IT infrastructure improvement
c) MCDAs shall set realistic targets for IT infrastructure improvement, prioritize gaps and
propose achievable solutions
7.3.3 Information Security Management

a) MCDAs shall establish an information security management framework as guided by the
information security standard
b) The Information Security function shall be separate from the IT department. The head of
the Information Security function may report to the CIO or have a dotted-line (indirect
reporting relationship to the CIO. The implementation of this requirement shall be guided
by appendix 12 depending on the risk levels of the organization.
7.3. 4Supplier management

a) All ICT suppliers and contractors Governmentshall be registered by the ICT Authority in
accordance with the requirements stipulated in Appendix 33
7.4 IT Service transition
7.4.1 IT Service change management
a) MCDAs shall develop a policy to ensure that any changes to IT enabled services are
conducted with minimal disruption to services
7.4.2 Knowledge management

a) MCDAs shall implement an ICT knowledge basewhichshall contain a database of common IT
service problems and how to solve them
7.5IT Continuous service improvement
7.5.1 Service and process performance review
a) MCDAs shall conduct annual performance reviews of IT processes and IT enabled services.
The review shall include suggestions for improvement. MCDA s shall seek guidance from ICT
Authority
b) MCDAs shall conduct benchmarking with the aim of identifying shortcoming and developing
plans for improvement
c) MCDAs shall in collaboration with ICT Authority, conduct regular system audits for all
systems to ensure compliance and conformity to the ICT standards.
8 Legal and Regulatory

8.1 Kenya laws on ICT
a) MCDAs shall identify the specific laws and regulations affecting IT in their organizations and
respond accordingly. The Kenya laws on ICT include:
i. Computer Misuse and Cybercrime Act 2018 -Information Security, Systems and
Applications
ii. Access to Information Act 2016- E-records, Systems, and Applications
iii. Kenya Information and Communications Act 2013- E- records and Data
Management, Systems and applications
iv. Evidence Act 2014- E-records and Data Management
v. Legal Notice 183, 2013( The Information and Communication Technology Authority
Order 2013)- IT Governance, Information Security, Systems and Applications, E-
records and Data Management
vi. Public Archives and Documentation Service Act 2012- E-records and Data
Management
14
vii. Industrial Property Act 2001 and CopyrightAct- End User Devices, Systems and
applications, cloud computing, Information Security
viii. Public Officers Ethics Act 2003- End-user devices, IT Governance, Systems, and
Applications
ix. NEMA guidelines on E-waste- End-User Devices
x. Private-Public Partnership Act 2013 – IT Governance
8.2 Roles and responsibilities

a) IT functions in MCDAs shall seek legal advice as necessary internally or externally to
better manage contracts
b) MCDAs shall seek technical advice or service from a competent third party as maybe
required from the ICT Authority.
9ICT Risk management

9.1 General
a) ICT risk management will be undertaken as guided in Appendix 21, 22 and 23
9.2ICT Risk framework
a) MCDAs shall develop a risk strategy
b) MCDAs shall set acceptable levels of risk.
c) MCDAs shall undertake a regular risk assessment for identification, recording, analysis,
and mitigation.
d) Responsibility for risk mitigation shall be assigned to the relevant function for
managing key risks depending on the type of risk and its possible impact, the MCDAs
shall adopt any of the following mitigation measures: Reduce, Transfer, Accept and
Mitigate risks.
10 Sourcing, Resourcing, and Financing of IT functions

10.1 General
a) To support IT Governance, MCDAs shall establish structures to manage IT resources as per
Appendix 11.
10.2 Sourcing of ICT equipment, products,and services
a) MCDAs shall source ICT resources while adhering to the GoK ICT standards. as per the
guidelines in Appendix 10
10.3 Resourcing
a) MCDAs should develop a guideline for the engagement of consultants, contractors and
external service providers. The guidelines should document the decision to acquire
external support. The guidelines should provide a framework for the accounting of the
consultancy, contracting and external service providers.
b) The MCDA should develop a risk assessment and management framework for the
consultants, contractors and external suppliers.
c) MCDAs while resourcing the ICT functions should ensure there is clear segregation of
roles in the assigned functions as per the GoKICT Human Capacity and Workforce
Development standard.
d) MCDAs must use a consistent and evidence-based ICT resources strategic planning
process.
e) MCDAs can use the public-private partnership to resource their ICT functions while
guided by the GoK PPP Legal and regulatory framework that includes Private Public
Partnership Policy, Private Public Partnership Act and Private Public Partnership
regulations.
f) All ICT professionals shall be registered as guided in Appendix 34 and the ICT human
capacity standard
15
10. 4 Financing
a) MCDAs shall allocate funds for ICT activities through the annual budget. The ratio of ICT
to the institutional budget shall be at least 5%
b) The budget shall be aligned to the ICT strategy
c) The budget shall be allocated for development and recurrent purposes
d) The development budget shall cover ICT Infrastructure enhancement and improvement
e) The recurrent budget shall cover ICT infrastructure maintenance and servicing
f) Donor funded government ICT initiatives shall be subject to the requirements of
government ICT standards.
10.5 Asset management
a) MCDAs shall maintain and update an inventory of all ICT assets. The inventory system shall
be automated and shall show relationships between these assets
b) MCDA should ensure that their ICT equipment are physically standard tagged for
identification and tracking.
10.6 Capacity building
a) The IT establishment shall cover all the relevant IT technical cadres including Basic
support, Network, systems and database administration, IT service management, IT project
management, Web administrators, information security officers, other contextual IT roles
b) MCDAs shall develop and implement ICT training policy in line with ICT human resource
development standard
c) The policy shall define required ICT qualifications for different cadres of staff as per the
ICT human capacity standard IT education, training, and development needs shall be fully
identified and addressed for all staff regularly
d) IT staff shall be trained on professional courses, ethics, and code of conduct outlined in the
ICT Human Capacity Development Standard
10. 7 Tools
a) ICT personnel shall be issued the relevant software and hardware tools to manage IT
resources (e.g. for user support, hardware maintenance, IT service and project
management, application development)
10.8Innovation
a) MCDAs shall establish a resource centre for IT research and innovation

b) The resource centre shall manage knowledge through databases and online resources to
spur innovation
Appendix1: Compliance Checklist for Enterprise Architecture

Enterprise YES/NO Comment
Architecture
MCDA has developed an Enterprise architecture as a
conceptual blueprint that defines the structure and
operation of ICT in an organization
MCDA has been guided by the approved Government
16
Enterprise Architecture when developing their

enterprise Architecture based on appropriate
business, application, information, and
infrastructure, security, performance and project
governance architecture to support the entire
ecosystem
Business Architecture
Business plans and objectives
MCDA has adapted principles of their specific
business architecture in line with the Government
Enterprise Architecture.
MCDA has clearly defined its ICT plans, objectives
and metrics that support business goals
MCDA has mechanisms for monitoring the
performance of ICT investments.
Business Process
MCDA has business processes designed and applied
to focus on service to Citizens provided as a single
interface through multiple access platforms
MCDA will seek to optimize business processes and
then use performance standards to define
automation requirements
Application Architecture
MCDA has ensured the design, implementation, and
delivery of the application architecture has adhered
to the application architecture principles as guided
by GEA.
Information Architecture
MCDA has adopted an appropriate analytical services
for discovery, interpretation of meaningful data
patterns
MCDA has implemented a master data management
to define and manage their critical data with
integration and a single point of reference.
Infrastructure Architecture
delivery of the infrastructure architecture has
adhered to the infrastructure architecture principles
as guided by GEA.
MCDA has implemented LAN/WAN, internet,
computing, enterprise networks, storage, and data
center to support business operations in line with the
GEA and Infrastructure Standard
Security and Compliance
delivery of information security shall adhere to the
information security architecture principles as
guided in the GEA
MCDA has established an information security
governance structure as guided by appendix 9 b
Project Management and Governance Architecture
delivery of ICT projects has adhered to the project
management and governance architecture principles
17
as defined in the GEA

Performance Architecture
Capability Maturity Model Integration (CMMI)
MCDAs have improved business goals or develop
process guidance models that provide a clear
definition to promote improved performance.
Balanced Scorecard
MCDA has an ICT Balanced Scorecard to measure
performance consisting of four perspectives: IT
Value, User, Operational Excellence, and Future
Orientation
Appendix 2: Compliance Checklist for ICT Governance
Checklist for
ICT Governance
Independent ICT Function YES/NO Comment
MCDA has a defined structure for the ICT function in
the organization reporting to the Accounting Officer
or the Chief Executive Officer (CEO).
ICT Governance Committees
MCDA has established two ICT governance
committees;
i) An IT Strategy committee to provide
strategic advice on ICT initiatives and
investments to the board as defined in
Appendix 9.
ii) An IT Steering Committee to define the IT
mission and goals aligned with the strategic
direction of the organization; authorize and
direct the development of the services and
operation plans as defined in Appendix 9
ICT Organization
MCDA has established an ICT organization structure
that adequately responds to the business goals,
mandate, and vision of the organization.
The head of the ICT function reports to the
accounting officer and shall hold either thefollowing
titles
i. Chief Information Officer
(CIO)
iii. Chief Information
Technology Officer (CITO)
iv. v. Chief Technology Officer
(CTO)
vi. vii. Director ICT (DICT) or Head
of IT(HIT)
IT strategy
IT is a strategic objective in the overall strategic
plan of the MCDA.
18
MCDA has prepared and maintained an ICT strategic

plan with a clear IT vision and mission that defines
how the MCDA plans to improve internal services and
services to businesses and citizens.
The strategy has been developed with input from
internal and external stakeholders.
The strategy has been informed by a situational
analysis of the internal and external business
environment
The strategy has defined specific tasks and
responsibilities for achieving value delivery from ICT
investment
The strategy has been implemented to achieve ICT
optimized investment
IT Project governance
MCDA has established a Project Management Office.
Projects are based on clear and compelling concept
and business case.
A project charter has been prepared for all projects.
A project implementation committee has been
created to report to the IT steering committee and is
led by a project manager.
MCDAs has adopted and approved a project
implementation methodology based on a globally
accepted approach such as PMBOK or Prince 2.
MCDA has adopted a software development
methodologies that include waterfall, agile, SDLC
and SCRUM. as guided by the Systems and
Applications standard
MCDA has carried out their project management as
guided in Appendix 11-19.
Appendix 3: Compliance Checklist for IT Legal and regulatory
Legal and Legal and Regulatory YES/NO Comment

Regulatory
19
Kenya laws on ICT

MCDAs has identified the specific laws and
regulations affecting IT in their organizations and
respond accordingly. The Kenya laws on ICT include:
Computer Misuse and Cybercrime Act 2018 -

Information Security, Systems and
Applications
Access to Information Act 2016- E-records,

Systems, and Applications
Kenya Information and Communications Act

2013- E- Records and Data Management,
Systems and applications
Evidence Act 2014- E-records and Data

Management
Legal Notice 183, 2013 ( The Information and

Communication Technology Authority Order
2013)- IT Governance, Information Security,
Systems and Applications, E-records and Data
Management
Public Archives and Documentation Service

Act 2012- E-records and Data Management
Industrial Property Act 2001 and Copyright

Act- End User Devices, Systems and
applications, cloud computing, Information
Security
Public Officers Ethics Act 2003- End-user

devices, IT Governance, Systems, and
Applications
NEMA guidelines on E-waste- End-User

Devices
Private Public Partnership Act 2013 – IT

Governance
Roles and responsibilities
IT functions in MCDA has sought legal advice

as necessary internally or externally to better
manage contracts
MCDA has sought technical advice or service
from a competent third party as maybe
required from the ICT Authority.
20
Appendix 4 Compliance Checklist for IT Service Management
Service Service Management YES/NO Comment

Management
IT Service Strategy
MCDA has developed an IT service strategy to create
new and improved services.
IT Service management
MCDA has a service charter for IT enabled services.
The charter defines the desired outcomes of the
services.
The charter defines the assets required to offer the
services.
MCDA, annually evaluates usage of the IT enabled
services and customer satisfaction.
Service level management
MCDA has developed and signed service level
agreement(s) (SLA) with service providers (internet,
systems support, maintenance, etc.) to ensure the
availability and reliability of IT enabled services.
The SLA shall define performance metrics for the
service providers.
MCDA monitors achievement of service levels and
compares them with agreed service targets in the SLA
SLAs has penalties for failure to meet agreed service
levels
Service desk
MCDA has established an IT service desk management
system to handle all requests from end-users
The service desk has 1st level, 2nd level, and 3rd level
support
The service desk has developed and documented
standard operatingprocedures for IT services
MCDA has a system to track customer complaints,
compliments, and resolution
IT Operations Control
MCDA has designated staff to manage the day to day
operational activities in IT e.g. back up, routine
maintenance, print and output management,
installations to ensure they are done in a reliable and
timely manner
MCDA has managed fraud using the COSO framework
MCDA has adopted IT service and governance
framework such as COBIT for internal controls and
management of IT
Business Relationship Management
MCDA has conducted and document customer
satisfaction surveys on IT enabled services annually for
internal and external customers
MCDA conducts training and awareness programs
21
annually to sensitize internal and external customers

on IT enabled services
IT Service Design
Availability Management
MCDA has developed and implemented quarterly
preventive maintenance plans for IT equipment
MCDA has developed and maintained manuals on how
to operate and maintain systems and equipment
MCDAs has developed a disaster recovery plan for all
services
IT Infrastructure Capacity Management
MCDA annually evaluates the capacity of IT
infrastructure to understand the current environment
and plan for future needs. The ICT Authority has
validated such evaluation
MCDA has established a framework for IT infrastructure
improvement
MCDA has set realistic targets for IT infrastructure
improvement, prioritize gaps and propose achievable
solutions
Information Security Management
MCDA has established an information security
management framework as guided by the information
security standard
The Information Security function has a separate from
the IT department. The head of the Information
Security function may report to the CIO or have a
dotted-line (indirect reporting relationship to the CIO.
The implementation of this requirement shall be
guided by appendix 12 depending on the risk levels of
the organization.
Supplier management
All ICT suppliers and contractors Government have
been registered by ICT Authority in accordance with
the requirements stipulated in Appendix 33
IT Service transition
IT Service change management
MCDA has developed a policy to ensure that any
changes to IT enabled services are conducted with
minimal disruption to services
Knowledge management
MCDA has implemented an ICT knowledge
basewhichcontains a database of common IT service
problems and how to solve them
IT Continuous service improvement
Service and process performance review
MCDA conducts annual performance reviews of IT
processes and IT enabled services. The review includes
suggestions for improvement.
MCDA has sought from the ICT Authority
MCDA has conducted benchmarking with the aim of
identifying shortcoming and developing plans for
improvement
22
MCDA has in collaboration with the ICT Authority,

conducted regular system audits for all systems to
ensure compliance and conformity to the ICT
standards.
Appendix 5 Compliance Checklist for ICT and Risk Management
23
Appendix6 IT Project Management

1.1 Project Governance
ICT Risk management
S/No YES/NO Comment

ICT Risk General
management MCDA has undertaken ICT risk
management as guided in Appendix
20, 21 and 22
ICT Risk MCDA has developed a risk strategy
framework
MCDA has set acceptable levels of
risk.
MCDA has undertaken a regular risk

assessment for identification,
recording, analysis and mitigation.
Responsibility for risk mitigation has

been assigned to the relevant
function for managing key risks
depending on the type of risk and its
possible impact, MCDA has adopted
any of the following mitigation
measures: Reduce, Transfer, Accept
and Mitigate risks.
a) MCDAs shall ensure that governance of all ICT projects comply with the governance
structures as per Appendix 7 and Appendix 30
1 Project initiation
a) The project shall have an objective and documented business case/ project proposal
b) The proposal shall define the expected benefits/outputs and outcomes
c) The project shall have appropriate approval
1.2 Project planning

a) The project shall have a project management plan with activity schedules
b) The project shall have risk management and communication plan
c) The project shall have an implementation, testing and training strategy
d) The Project shall have a stakeholder management plan
1.3 Analysis and design

a) The project shall have user requirements
b) The project shall have user systems and technical specifications
c) The project shall have a system acceptance test plan
1.4 Project Building and testing
a) There shall be a development and test environment
b) There shall be operational and training procedures
c) There shall be detailed test plans
1.5 Project Implementation
24
a) There shall be a system installation and migration plan

b) There shall be a data conversion plan
c) There shall be a training and contingency plan
1.6 Project Completion
a) There shall be a post-implementation review report
b) There shall be a documented system support group
c) There shall be project closure sign off
Subject Requirement
Appendix7 Performance management

1.1 IT service management
a) Overall financial performance (costs v. budgets)
b) Performance with respect to reliability and availability of critical services
c) Complaints (QOS) and customer perception
d) Number of significant reactive fixes to errors
e) SLA performance by third parties
f) Relationships with suppliers (quality & value)
g) Capability e.g. process maturity
h) Internal and external benchmarks
i) Business continuity status
1.2 Project management

a) Major project delivery performance (objectives, time and budget)
b) ROI for IT investments (business benefit)
1.3 Risk management

a) Status of critical risks
b) Audit weaknesses
c) Human Resource measures for people involved in IT activities
Appendix 8 Risk management
25
Define a framework MCDAs has ensured the following staff are trained in risk management in their
specific areas :(e.gCobiT, ISO17799, ITIL, ISO9000
PMBOK and Prince2)
 IT Auditors
 IT Project Managers
 IT Risk Managers
 Business Analysts
 Infrastructure Management
 Procurement/Contract Management
 IS Strategy – alignment with the business
 Quality Management
 Business Relationship Management
 Programme Managers
MCDAs shall conduct benchmarking to compare how risk management is being
addressed within the organization in relation to best practice, industry peer
groups and other organizations.
Identify risks MCDA has ensured that new risks are identified in a timely manner?
The following risks are identified
 Business-specific risk (e.g. Operational risk of mandate not being

delivered)
 Generic common IT risk (e.g. IT availability risk)
 Specific IT risk (e.g. Denial of service attack on Internet customer request
system)
Identify probable risk Auditors provide initial momentum by highlighting to senior management
owners inadequate risk management practices of specific risks that are not being
adequately addressed?
Responsibility is allocated at a senior level for managing key risks?
Every risk has an owner?
MCDAs has adopted a mechanism for reporting issues – ultimately to the individual
who has toretain overall responsibility?
Evaluate the risks MCDAs has set acceptable levels of risk
MCDA has developed a risk register.
The risk register has a prioritized list of risks which must be subsequently
addressed?
Identify suitable MCDA has implemented suitable response to risks

response to risk
26
Appendix 9
IT GOVERNING COMMITTEES
a) Committees
Level IT Strategy Committee IT Steering Committee

Responsibility -Provides insight and advice to the board - Decides the overall level of IT spending
on topics such as: and how costs will be allocated
-The relevance of the development in IT - Aligns and approves the enterprise’s IT
from a business perspective architecture
-The alignment of IT with the business - Approves project plans and budgets,
direction setting priorities and milestones
-The achievement of strategic IT - Acquires and assigns appropriate
objectives resources
-The availability of suitable IT resources, - Ensures that projects continuously meet
skills and infrastructure to meet the business requirements including a
strategic objectives reevaluation of the business case
-Optimization of IT costs, including the - Monitors projects plan for delivery of
role of and value delivery of external IT expected value and desired outcomes,
sourcing on time and within budget
-Risk, return and competitive aspects of - Monitors resource and priority conflict
IT investments between enterprise divisions and the IT
-The contribution of IT to the business. functions as well as between projects.
-Exposure to IT Risks, including - Makes recommendations and requests
compliance risks for changes to strategic plans (Priorities,
-Direction to management relative to IT funding, technology approaches and
strategy resources)
-Drivers and catalysts for the boards IT - Communicates strategic goals to
projects teams
- Is a major contributor to management’s
IT governance responsibilities and
practices
Authority -Advises the board and management on IT - Assists the executive in the delivery of the IT
strategy strategy
-Is delegated by the board to provide - Oversees the day to day management of the IT
input to the strategy and prepare its service delivery and IT projects
approval - Focuses on implementation
-Focuses on the current and future
strategic IT issues
Membership Board members and specialists non board -Sponsoring executive
members -Business executive
-Chief information officer
-Key advisors as required (IT, audit, legal,
finance)
27
b) Sub Committees
Committee Responsibilities Membership

Information Security Sub-  Facilitates achieving  C-level executive
Committee consensus on priorities management and senior
and trade-offs. managers from IT,
 Serves as an effective  application owners,
communications  business process
channel and provides owners,
anongoing basis for  operations,
ensuring the alignment  HR, audit and
of the security program  legal
withbusiness
objectives.
 The committee will
deliberate on the
suitability of
recommended controls
andgood practices in
the context of the
organization, including
the secureconfiguration
of operating systems
(OSs) and databases.
Project steering committee – Reviews project progress  a senior representative
regularly (e.g., semimonthly or from each business area
monthly) and  The project manager
Holds emergency meetings  The projectsponsor who
when required. assumes the overall
– Serves as coordinator and ownership and
advisor. Members of the accountability of the
committee should be projectand chairs the
available to answer questions steering committee.
and make user-related decisions
about
system and program design.
– Takes corrective action if
necessary due to project
progress and issues
escalated to the committee.
Appendix10 Guidelines for Sourcing

a) MCDAs should evaluate its ICT function and determine the most appropriate method of
delivering the ICT function based on the following;
1. Is this a core function of the organization
2. Does this function have specific knowledge, processes, and staff critical to meeting its goals
and objectives and that cannot be replicated externally or in another location?
3. Can this function be performed by another party or in another location for the same or lower
price, with the same or higher quality and without increasing risk?
4. Does the organization have experiences managing third parties or using remote/offshore
locations to execute IS or business functions?
5. Are there any contractual or regulatory restrictions preventing offshore locations or use of
foreign materials.
28
b) On completion of the sourcing strategy, the IT steering committee should review and approve
the strategy. At this point, if the committee has chosen to use outsourcing, a rigorous process
should be followed including the following steps
1. Define the IT function to be outsourced
2. Describe the service levels required and minimum metrics to be met
3. Know the desired level of knowledge, skills, and quality of the expected service provider
4. Know the current in-house cost information to compare with third party bids
5. Conduct due diligence reviews of potential service providers
6. Confirm any considerations to meeting contractual or regulatory requirements.
29
Appendix 11GoK Project Management Governance Structure
30
Appendix 12: ICT Organization Structures

i. Large MCDA’s
Chief Information
Officer Or IT
Manager/Director
Security Service Service Technical

Support Applications Operations Projects
Administrator Delivery architecture support
Manager manager manager manager
Manager manager Manager
Disaster Recovery Enterprise

Coordinator Programmers Service desk Enterprise System Database
architecture Systems
(Applications) Programmers(OS) Administrator
Support
Systems ITSM systems System Network

Capacity
Analysts Incident Support Adminstrator(OS) Operations
manager
(Applications) management Center
Network Service
Quality Change Availability
Administrators(OS) Operations
Assurance management Manager
center
Continuity Security
CSI Manager Manager Operations
Center
Business
Relationship
Manager
Supplier
Relationship
manager
31
Chief
information
Ofiicer Or IT
Manager
Service Technical
Systems Analysts Quality Delivery Support
(Applications) Assurance Manager Manager
- Network - Systems
Help Desk Administrator(WAN/LAN) Programmer(Operati
Oficer ng System)
- Systems
Administrator(Operating - Systems
Systems) Analysts(Operating
System)
ii. Medium MCDA’s
iii. Small MCDA’s
Chief Information
Officer/IT
Manager/Director
System Network
Developers
Administrator(1) Administrator
32
Appendix13: Project governance roles

Project Role Accountabilities, responsibilities and tasks
Corporate Client
- Has ultimate authority in large, complex or politically driven projects.
- Is the champion of the project, promotes the benefits of the project
to the community and may be viewed as the ‘public face’ of the
project. For example, the Corporate Client may be the Premier,
Minister of the State or Head of Agency.
- May also be the Project Funder.
In a small, less complex project, there would be no Corporate Client, but the
Project Sponsor would act as the champion of the project, and fulfil the role
of the Project Champion.
Project Sponsor
- Ultimately accountable and responsible for the project, and is
sometimes referred to as the Project Owner.
- Responsible for the attainment of the agreed Project Target
Outcomes. The Target Outcomes should be secured before the project
is closed formally.
- Member of the Steering Committee, and is usually the Committee
Chair. For projects where there is no Steering Committee, the Sponsor
assumes responsibility for approving the project scope and all
subsequent decision-making.
- Oversight of the business management and project management issues
that arise outside the formal business of the Steering Committee.
- Provides support by advocacy at senior levels, and ensures that the
necessary resources (both financial and human) are available to the
project.
- May also be the Business Owner for the project and can also be the
Funder, but it varies within government, depending on the budgetary
arrangements and decisions about who will be managing the Outputs
after the project closes. In the case of large whole-of-government
projects, the project funds may be managed by one Agency on behalf
of the government, but there may be several Business Owners.
The Corporate Client and Project Sponsor may be the same person for
some projects.
The Project Sponsor must be identified for all projects, no matter what
the size or complexity.
Accountable to: Corporate Client (where applicable)
Steering Committee
- Responsible and accountable for policy and resourcing decisions
essential to the delivery of project Output and the attainment of
project’s Target Outcomes.
- Accountable to the Corporate Client and/or Sponsor for providing
the Project Manager and Team with effective management and
guidance in the development of the project Outputs and
33
implementation of required organisational change, in order to

attain the project’s Outcomes.
- Responsible for ensuring appropriate management of the project
components outlined in the endorsed Project Business Plan, which
usually includes approving the initial Project Proposal or Business
Case and then the Project Business Plan.
- Responsible for assessing, approving or rejecting changes to the
scope as documented in the Project Business Plan as the project
progresses.
- Responsible for monitoring progress (not just activity) and
scrutinising the project’s budget.
- Ultimately accountable for ensuring appropriate risk management
processes are applied, which may include responsibility for
undertaking specific risk management activities.
- Must also consider how (or if( the project’s objective(s(,
Outcomes, Target Outcomes, and longer-term business benefits
align with the organisational strategic agenda and direction, and
making the hard decisions to re-scope or terminate the project if
there is little or no alignment.
- Should develop an agreed Terms of Reference for how the
Steering Committee will operate.
The composition of the Steering Committee may change as the project

moves through its various phases or stages, to ensure the best expertise
and experience are available when required.
Not all projects require a Steering Committee. The need for a Steering
Committee is dependent on the complexity and nature of the project and
is determined by the Corporate Client and/or Project Sponsor.
Accountable to: Corporate Client (where applicable) or Project Sponsor
(Refer to Appendix 3 Steering Not Rowing: A Charter for Project Steering
Committees and Their Members.)
Business Owner(s)
- Responsible for managing the project Outputs for utilisation
by Project Customers.
- Responsible for ongoing maintenance (including costs) of the
project Outputs after the project closes.
- Accountable to the Project Sponsor and/or Corporate Client
(or their delegate(s)) following formal project closure for the
achievement of and reporting against the project’s Target
Outcomes and realisation of the longer-term business
benefits.
- Must be satisfied that the project’s Outcomes (including
Target Outcomes( and longer term business benefits are
meaningful in the context of the Business Unit’s operational
environment and forward strategic agenda.
- Contracted by the Project Sponsor and/or Steering Committee
to implement the change management described in the
Outcome Realisation Plan, and thereby achieve the project’s
Outcomes, Target Outcomes and realise the business benefits.
- May be required to contribute resources to the project to
ensure the change management described in the Outcome
34
Realisation Plan is implemented effectively.

- ‘Owns’ the Project Outcome Realisation Plan, although the
Project Manager may assist in its development.
- Must be satisfied that the project scope includes all of the
Outputs necessary for the realisation of the project’s Target
Outcomes and agreed business benefits.
- May be required to contribute resources to the project to
ensure that the Outputs are developed satisfactorily and ‘fit
for purpose’.
- Responsible after project closure for ensuring the project’s
Target Outcomes and agreed longer-term business benefits
are used to revise the Business Unit’s relevant performance
measures. Agency or Divisional Corporate or Annual Business
Plans should be updated appropriately. Reporting lines and
requirements may also need to be updated post-project.
- Responsible after project closure for ongoing ownership and
maintenance of the project Outputs, which may require
revised budget forecasts to accommodate maintenance costs
and staffing implications.
Project Customers
The person or entities that will utilise the project Outputs to undertake their
own activity, and therefore unconsciously generate the project Outcomes and
business benefits as a by-product of this utilisation. For example, the
Tasmanian public, who transacts business with Service Tasmania, would have
been classed as Project Customers when the entity was set up. Project
Customers are sometimes described as Beneficiaries
Project Observer
- May be a role in a large, complex or politically driven project,
possibly involving whole-of-government or more than one
Agency where potential learnings through observation of
project processes are possible.
- Usually present at Steering Committee meetings or Project
Team meetings to act as an information channel to the
Agency/organisation they are representing.
- The Observer’s Agency may not necessarily be represented on
the Steering Committee if they are not Business Owners.
- Cannot participate in decision-making while attending
meetings.
- May raise issues for discussion on the understanding that those
issues may or may not be addressed or resolved as part of the
meetings. The issues may be considered outside of the formal
meeting structure.
- Accountable to the Agency they are representing. If issues
arise that may have implications for the Agency/organisation,
they have a responsibility to report these issues back to their
Agency/organisation. The Agency/organisation may then wish
to raise these issues formally with the Project Sponsor.
Please note: The Project Sponsor and/or Steering Committee Chair should
agree to the role of the Project Observer before that role is implemented.
Quality Consultants
- Work independently of the Project Team.
35
- Often contracted from outside the Agency/organisation.

- Maybe contracted to undertake formal Quality Review of the
project as a whole in terms of structure, processes, and
progress toward Outputs.
- Maybe contracted to undertake formal Quality Review of the
quality of products or services (Outputs) being produced
within a project in a technical field (eg law, IT, construction).
(Refer to Appendix 4 A Charter for Project Management Quality Advisory

Consultants and Appendix 5 A Charter for Project Management Quality Review
Consultants.)
Accountable to: Project Sponsor and/or Steering Committee
Project Director
- Usually created to manage a large, complex or politically
sensitive project or program of projects in partnership with
one or several Project Manager(s).
- Responsible for the implementation of the Project/Program
Business Plan following its approval by the Steering
Committee.
- Directs and monitors project/program activity through quality
management, detailed plans and schedules, and reports
progress to the Steering Committee.
- Provides expert and authoritative advice to various Ministers,
Heads of Agency and senior representatives of the public and
private sectors and key community stakeholders on a wide
range of sensitive issues associated with the project/program.
- Provides highest-level leadership by articulating the
project/program vision, and negotiating and defining
objectives and developing and nurturing highest-level
relationships with stakeholders and end users, to facilitate the
effective delivery of a major government initiative.
Accountable to: Project Sponsor and/or Steering Committee

Project Manager
- Contracted by the Project Sponsor and/or Steering Committee
to deliver the defined project Outputs as articulated in the
approved Project Business Plan.
- Works in partnership with and reports to the Project Director
to implement the Project Business Plan.
- Responsible for engaging the Project Sponsor, Business
Owner(s) and/or Steering Committee in order to clarify the
project Objectives, Outcomes, Target Outcomes, required
Outputs and stakeholders within agreed time, cost and quality
parameters.
- Develops and maintains the Project Business Plan, Project
Work/Execution and Implementation Plan(s) and related
schedules.
- Responsible for organising the project into one or more sub-
projects, managing the day-to-day aspects of the project,
resolving planning and implementation issues, and monitoring
progress and budget.
- Reports to the Project Sponsor and/or Steering Committee at
regular intervals.
- Manages (client/provider/stakeholder) expectations through
36
formal specification and agreement of the project

objective(s), Outcomes, Target Outcomes, Outputs, quality
requirements, resources required, budget, schedule, project
structure, roles, and responsibilities.
- Requires demonstrated high-level project management skills.
A Project Manager cannot lead effectively unless they have
credibility. For most projects, it means the Project Manager
must have knowledge of how the Outputs will be created, and
how the Target Outcomes will be realised from the utilisation
of those Outputs as described in the Outcome Realisation
Plan.
The Project Manager must be identified for all projects, no matter what the
size or complexity.
Accountable to: Project Director (where applicable), Project Sponsor and/or
Steering Committee
Project Team
- Led by the Project Manager or Project Team Leader.
- Responsible for completing tasks and activities required for
delivery of the project Outputs, as outlined in the Project
Business Plan and elaborated in the Project Execution and/or
Implementation Plan(s).
- Usually includes representatives from the Business Unit(s)
impacted by the project.
- Must include the requisite skills for each phase of a project to
ensure success. The skills should be explicitly identified as a
part of the project planning process.
The composition of the Team may change as the project moves through its
various phases.
Accountable to: Project Manager and/or Project Team Leader.
Project Team Leader
- Usually appointed in large and/or complex projects to work
under the direction of the Project Manager.
- May be a representative of a Business Unit impacted by the
project.
- Responsible for completing the required tasks and activities as
defined in the Project Execution and/or Implementation
Plan(s) for delivering the project Output(s).
-
Accountable to: Project Manager
Project Officer
- Responsible for completing tasks and activities required for
delivering project Output, as determined by the Project
Manager or Project Team Leader.
- Most common responsibilities are related to project
coordination (eg administration, including development
and/or maintenance of project documentation, assisting with
status reporting and follow-up), stakeholder liaison (eg
secretarial support to the project reference group or project
communications) and general administrative support activities
(eg scheduling and meeting preparations).
- May also be directly involved in the development and quality
assurance of specific Outputs.
37
-
Accountable to: Project Manager or Project Team Leader
Reference Groups
- Provide forums to achieve consensus among groups of
stakeholders.
- Do not do the work of Output production, but may
ratify/endorse Output quality on behalf of the stakeholders
they represent.
- The group may already exist, have an indefinite life span or
may continue for the life of the project.
- Maybe a general reference group delegated by the Steering
Committee to monitor or modify the Project Business Plan for
approval by the Steering Committee.
- May consist of collection of people with like skills to address a
particular set of issues.
- May report to the Steering Committee or Project Manager,
depending on who has appointed them and what they are
requested to achieve.
- Members provide an excellent channel to assist the project
communicate information to and from their stakeholder
group(s) who may be impacted by, or impact on, the project.
Accountable to: Project Sponsor and/or Steering Committee via the Project
Manager or Project Director (where applicable)
Advisory Groups
- Forums of stakeholders, usually experts to provide specific
advice or technical expertise to the project.
- Do not do the work of Output production, but may advise the
Project Manager on Output quality (‘fitness-for-purpose’( on
behalf of the stakeholders they represent.
- Able to advise the project of any emerging issues from a
stakeholder perspective.
- Members may also be willing to play an ongoing role in Output
maintenance after the project has closed, to ensure the
Outputs remain relevant and retain their practical utility.
- May report to the Steering Committee or Project Manager,
depending on who has appointed them and what they are
requested to achieve.
- The group may already exist, have an indefinite life span or
may continue for the life of the project. An information
technology advisory group is an example.
Working Groups
- Small specialist work groups, each dedicated to producing a
well-defined Output within a specific timeframe, appointed
by the Project Manager.
- Report directly to the Project Manager. May also report to the
Reference/Advisory Group on Output development progress.
- Membership may be drawn from Reference or Advisory
Groups, or the Business Unit(s) where Output implementation
38
will occur.
- May have no life beyond the delivery of that Output.
- Probably involve one or more members of a Project Team to
support activity.
- Members may also be willing to play an ongoing role in Output
maintenance after the project has closed, to ensure the
Outputs remain relevant and retain their practical utility.
Accountable to: Project Manager or Project Director (where applicable)

Consultants - Are employed from outside the organisation to provide independent,
high-level specialist expertise or professional advice unavailable from
internal resources, to assist project decision-making.
- Typically Project Consultants may include:
o Information technology specialists who define and manage the
technological aspects of the project
o Representatives employed by stakeholders to ensure their
interests are represented and managed
o Legal advisers who assist in the development and review of
the contractual documentation
o Auditors who ensure compliance with internal and external
audit requirements
May report directly to the Chair of the Steering Committee (or perhaps the
Chair of a general Reference Group).
Please note: The Head of Agency or Deputy Secretary (or equivalent) must
approve any decision to engage a consultant prior to the Agencyundertaking
the appropriate procurement process.
Contractors Are employed, external to the business area, to provide a specified service in
relation to the development of project Outputs. Examples include developing
guides and/or manuals, business application software, develop and deliver
marketing programs, prepare and deliver training to staff in the business area.
May be engaged to undertake work as part of the Project Team.
Appendix 14: Project management documentation

PHASE Key documents Other documents Proformas
INITIATE Project Proposal Business Needs Analysis

Feasibility Study Report Project Brief
Project Business Case
MANAGE Project Business Plan Risk Management Plan Project Status Report
Project Execution Plan Stakeholder Project Risk Register
Project Review and Engagement Plan Project Issues Register
Evaluation Report Organizational Change
Project Phase Review Management (or
Report Transition) Plan
Implementation Plan
Project Communication
39
Strategy and Action

Plan
Marketing Strategy
Training Strategy
FINALISE Outcome Realization Handover Plan
Plan Project Output
Project Closure Report Management Plan
Project Review and
Closure Report
Appendix 15: Project management stages and activities

Key Element INITIATE SET UP MANAGE FINALISE
  
1. Planning and scoping
   
2. Governance
   
3. Outcome Realization
   
4. Stakeholder engagement
   
5. Risk management
  
6. Issues management
   
7. Resource management
  
8. Quality management
40
  
9. Status reporting
  
10. Project review and evaluation
 
11. Project closure
Appendix 16: Project documentation development
41
Appendix 17: A generic project governance model for larger, more complex projects
42
Appendix 18: Sample Outcome Realization data for the Project Business Plan
Target Performance Measure Baseline Target Level Target Date Accountabili

Outcome Indicator ty
The A The actual The current The The date by Who is

measurable description mechanism level of the targeted when the accountable
benefits of the type for performance level of target levels for the
that are of change measuring indicator as performance are to be achievement
sought from that will the level of at [date] (i.e how achieved of the
undertaking indicate the success is targeted
a project performance performance defined outcomes
(i.e what we towards the indicator and reports
want to achievement on the
achieve) of the progress
Target towards the
Outcomes target?
Appendix 19: Stakeholder engagement process
43
 Appendix 20: Stakeholder engagement process

[NB appendix 19 expounds on appendix 18]
Verbal Electronic Written Visual
o Presentations/bri o Personal email to o Mailouts of o Display –

efing sessions identified important workplace,
(one-to-one, one- stakeholders (one documentation conference
to-many) to one, one to (letter, o Transport
o Telephone (one- many) memorandum, advertising
to- o Broadcast email factsheet, FAQs) o ‘Roadshow’
one)/Teleconfere (one to many) o Newsletter o ‘Parody’
nces (one-to- o Internet/intranet o Advertising – presentation –
many) including online newspaper, play, puppet
o Forums forums, fact magazine, web show
o Networking sheets, newsletter, o Pamphlets and o 3D presentation
facilitation SharePoint – web brochures
o Staff meetings sharing of ongoing (consider shelf
o Seminars/worksh project planning life issues)
ops with internal o Information in
o Community and/or external agency
meetings stakeholders newsletters etc
o Launches o SMS messaging o Media release
o Specific events o Weblog o Ministerial
o Social gatherings o Facebook, o Request for
o Visitation Myspace, YouTube Tender (RFT)
programs o Twitter o Contract
o Radio/television o RSS Feed o Project planning
o CD-ROM/DVDs documentation
o Fax stream,
faxback
44
Appendix 21: Elements of the risk management process
45
Appendix 22: Risk matrix for grading risks

Seriousness
Likelihood Low Medium High Extreme

(Insignificant
adverse (Reasonable (Will have
impact, note adverse significant
only) impact, needs adverse
monitoring) impact)
Low N D C Extreme
(Unlikely to
occur during
project)
Medium D C B Extreme
(May occur at
some stage in
project)
High C B A Extreme
(Probably will
occur during
project)
46
Appendix 23: Recommended actions for grades of risk

Grade Risk Mitigation Actions Who
A & Extreme Mitigation actions to reduce the Project Steering Committee

likelihood and seriousness to be and/or Project Sponsor
identified, costed and
prioritized for implementation
before the project commences
or immediately as they arise
during project execution.
B Mitigation actions to reduce the Project Steering Committee

likelihood and seriousness to be and/or Project Manager
identified costed and
prioritized. Appropriate actions
implemented during project
execution,
C Mitigation actions to reduce the Project Manager

likelihood and seriousness to be
identified and costed for
possible action if funds permit.
D&N To be noted; no action is needed Project Manager

unless grading increases over
time.
47
Appendix 24: Issue management flowchart
48
Appendix 25: Sample Project Issues Register
Issue Description Raised By Date Priority Respons Actions & Status Date
Number ible Progress Resolved
Officer Notes
1.1 Lack of Working 1/09/2 High Jane Letter of Open

agency Group 2 invitation
representat from
ion on Project
Project Sponsor
Working (i.e
Group Director)
to
agencies
which are
not
represent
ed
2.1 Lack of Project 1/11/2 High Senior Send out Open

registrants Manager 2 Project reminder
for next Officer via email
forum to the
project
managem
ent
communit
y of
practice.
1.3 How to Project 10/09/ Medium Senior Matrix to Closed 30/11/22

show links Team 22 Project be
between member Officer developed
PM and
documents published
49
Appendix 26: Project closure
50
Appendix 27: Sample Service Management structure (ITIL) for Small organizations
Head of IT
Service Business Programme

Management Teams Management
Service Desk Infrastructure Business Analysis
Systems
• Incident Mgmt • Business Analysis
• Problem Mgmt Application • Project Management
Support
• Service Requests • Change Management
• Change Co-ordination • Commercial Mgmt
• SLA Reporting • 2nd/3rd Level Support • Account Management
• Vendor Mgmt • Problem Resolution • Contracts/Procurement
• Design & Planning
• Maintenance
• Projects
• Change ‘Building’
51
Appendix 28: Sample Service Management structure (ITIL) for large organizations
Head of IT
IT Service Development Strategy

Manager Manager Manager
Business Account
Service Support Service Delivery
Teams Management
Application Security
Service Desk SLA Manager
Development
Application IT Architect
Problem Manager Testing Manager
Support (?)
Special
Availability
Tech Support Projects
Manager
Contracts/
Operations Capacity Manager Procurement
Desktop Support IT Continuity
Network Support Financial Manager
Change/Config
/Release
Application
Support (?)
52
Appendix 29: Service desk 1st, level, 2nd level and 3rd level support definitions
GENERAL DEFINTIONS
First Level Support
 Dedicated and managed Support area/telephone access

 Routine call and incident taking, logging and classification
 Initial fast resolutions to Routine Incidents – e.g. password resets
 Short term support to keep lines open and provide access to IT
 Calls within target guidelines before escalation – e.g. 5 - 10 minutes
 Generally at least 40% - 50% of calls resolved
Second Level Support
 Dedicated and managed Support area

 Longer resolution Incidents – e.g. more than 5-10 minutes
 Incidents that require greater technical knowledge or system access
 Fast Response and Target resolution times – support is highest priority
 Task to build Knowledgebase to ensure future response in Incident Management/1 st Level
 Involvement in the technical analysis and resolution of underlying Problems
 Generally 40% - 50% of calls resolved
Third Level Support
 Long Term Problem resolution

 Incidents/Problems that require high level of technical knowledge or system access
 Task to build Knowledgebase to ensure future response in Incident Management/1 st or 2nd Level
 Generally less than 10% of calls handled
53
APPENDIX 30: SAMPLE ICT STRATEGY FORMAT
ICT STRATEGY FORMAT & TEMPLATE
STRATEGIC PLAN FORMAT and TEMPLATE

Strategy Development Process
Where we are Where we want to be How we will do it How are we doing
Assessment Baseline Components Down to Specifics Evaluate
• Environmental Scan • Situation – Past, • Mission & Vision • Performance • Performance

Present and Future Measurement Management
• Background • Significant Issues • Values / Guiding • Targets / Standards of • Review Progress –
Information Principles Performance Balanced Scorecard
• Situational Analysis • Align / Fit with • Key Objectives • Initiatives and • Take Corrective
Capabilities Projects Actions
• SWOT – Strength’s, • Gaps • Action Plans • Feedback upstream

Weaknesses, – revise plans
Opportunities,
Threats
Note: All Strategic plan proposals should be accompanied with a ‘Table of Contents’ and should be in the order depicted below.
Executive Summary
Give brief outline of the (Org/Dept).
55
Environmental Analysis
Internal Environment
[Internal Assessment: Organizational assets, resources, people, culture, systems, partnerships, suppliers, etc]
External Environment
[External Assessment: Marketplace, competitor’s, social trends, technology, regulatory environment, economic
cycles, etc]
56
Tools for comparison analysis
[It involves specifying the objective of the institution or project and identifying the internal and external
factors that are favorable and unfavorable to achieving that objective.]
Examples:
SWOT Analysis; Six Forces Model; VRIO; PEST analysis; Porter's Four Corners Model
Benchmarking
[Benchmarking is the process of comparing one's business processes and performance metrics to industry bests
and/or from other industries. Dimensions typically measured are quality, time, and cost. Improvements from
learning mean doing things better, faster, and cheaper.
Benchmarking involves management identifying the best institutions in their industry, or any other industry
where similar processes exist, and comparing the results and processes of those studied (the "targets") to one's
own results and processes to learn how well the targets perform and, more importantly, how they do it.]
57
Best practices
[A bestpractice is a technique, method, process, activity, incentive, or reward that is believed to be more
effective at delivering a particular outcome than any other technique, method, process, etc. when applied to
a particular condition or circumstance. The idea is that with proper processes, checks, and testing, a desired
outcome can be delivered with fewer problems and unforeseen complications. Best practices can also be
defined as the most efficient (least amount of effort) and effective (best results) way of accomplishing a task,
based on repeatable procedures that have proven themselves over time for large numbers of people.]
Gap Analysis
[Identify the gap between the optimized allocation and integration of the inputs, and the current level of
allocation. This helps provide the institution with insight into areas which could be improved. The gap analysis
process involves determining, ‘where you are now’ and ‘where you want to be’.]
58
Strategic Plan
The strategic plan should be communicated to all relevant individuals, including stakeholders and sponsors. It should include the following:
Vision
[What the org/dept wants to be; it should be compelling, vivid and concise, challenges everyone to reach for
something significant – inspires a compelling future; it is time bound. An organization’s Vision sets out its
aspirations for the future. The Vision is the 'dream' of the future, a picture painted in words, which is intended
to inspire people by appealing to the heart as well as the head.]
Mission
[Our purpose of existence; should be brief and to the point; it provides context for major decisions and
capable of infinite fulfillment; it is not time bound].
59
MISSION Formulation
Answer each of these questions.
What services and/ or products will the organization/department offer?
Who are the people who may use or benefit from this services or products?
What are the reasons for the organization/ department?
Why will the organization/ department exist?
Now combine all the answers into one statement of purpose.
60
Values
[Values will guide every major decision making; it embodies the spirit of the org/ dept; revisit Vision and
Mission statement.]
Strategic Objectives
List specific actionable results needed to support the vision and the mission. Use the mnemonic SMART/ER
S Specific
M Measurable
A Attainable
R Relevant
T Time bound
And
E Evaluate
R Reevaluate
61
Initiatives
[These are actions that will lead to achievement of your objectives, often taking the form of projects or
programs]
Measures (KPI(s), Timeline and Deliverables
[These are objective, quantifiable methods for measuring success. Indicators and monitors of success. It
includes; performance measurement, initiatives and projects and action plans.]
[Each Initiative has a supporting Action Plan(s) attached to it. Action Plans are geared toward operations,
procedures, and processes They describe who does what, when it will be completed, and how the organization
knows when steps are completed Like Initiatives; Action Plans require the monitoring of progress on
Objectives, for which measures are needed]
Quick wins
[These are improvement which is expected to provide a Return on Investment in a short period of time with
relatively small cost and effort.]
62
Organization Structure
[Organizational structure allows the expressed allocation of responsibilities for different functions and
processes to different entities such as the department, workgroup and individual. Please provide a diagram]
63
Resource
Personnel
Finance/ Budget
Facilities/ equipment
Summary (include a 5 by 5 year timeline towards 2030
64
APPENDIX 31: Who needs to be involved in Legal contracts

Investors Providers Controllers
• The Board • Project and change managers • Internal audit and external
(IT and Business) audit (due diligence)
• IT Council/Management Team
• Project and change managers • External regulators
• Senior business unit managers (IT and
e.g. key customers of IT services • Corporate governance
Business) coordinator
• Business Partners
• Programme managers • Risk managers
• External
investors/shareholders – as part • Business managers and users • Compliance – regulatory and
of corporate governance internal
• Technical delivery and support
teams • Finance/Project Managers/IT
and business
• Key players e.g. Business
sponsors, Project managers – reviewers of
benefits/ROI
champions
• Post investment appraisal/Post
• Relationship managers and project
internal
review teams
communications teams
• Suppliers (especially
outsourced service providers)
• Contract and procurement

management
• Peripheral
players/influencers/Policy
owners
e.g. HR, Facilities Management,

Legal
Legal and regulatory Responsibilities
• Understand requirements • Advise on IT related technical • Maintain awareness of current

(what regulations are to be and and emerging laws, and
complied with) regulations affecting IT to assess
commercial risks that could their impact on the
• Set the mandate impact legal and regulatory organization’s business
requirements
• Set priorities and expectations • Develop an understanding of
• Provide proposals and business their impact on
• Establish and ensure the cases for
expected degree of compliance the organization and advise
legal and regulatory accordingly on “what is needed”
• Based on advice concerning programmes, projects or action
risk and cost: - not necessarily “how”
plans
• Assess impact on business • Monitor adequacy of controls
• Formulate solutions for
65
• Provide resource and funding compliance or commercial and

to ensure issues are addressed contracts
compliance processes
• Define who is accountable • Identify best practices for
ongoing good control of legal • Monitor the business and IT
• Obtain internal or external and regulatory requirements functions
assurance as required that issues
have been addressed and • Exploit technology and tools for performance in meeting legal
controls established where and
• Monitor and evaluate appropriate for ensuring regulatory requirements and

compliance compliance (e.g. report back to management with
advice regarding any
programmes and significant asset registers) shortcomings
commercial contracts
• Execution of compliance and • Provide independent assurance
• Sign off specific compliance contractual processes, and to
programmes operation of elated controls
management that adequate
• Provide approvals when • Provide compliance framework controls are in place to deal
required for to ensure a sustainable with legal and regulatory
“business as usual” approach to
significant legal or regulatory compliance requirements
decisions
• Provide evidence of
compliance
• Provide information relating to

the cost of compliance and also
cost of any incidents
• Evaluate impact on business

environment together with
business units
• Ensure vendors, service

providers, and subcontractors
are involved properly and
integrated within the overall

compliance
approach
66
Appendix 32: Risk management process
Appendix 33: Accreditation of ICTService Providers

A. REGISTRATION
i. An application for registration as a contractor/suppliershall be made in theprescribed form and
shall beaccompanied by-
a. Duly signed Code of Conduct for ICT service providers (ICTA/STD/006)
b. Certified copies of statutory documents and other relevant documents asarenecessary
toprovequalification forregistration:
c. The ICT service providers shall adhere to the following code of conduct
Code of Conduct for ICT service providers:
i. Ensure government receives competent professional services.
ii. Enhance the professional development of its staff.
iii. Respect the confidentiality of any information given by government institutions
iv. Enhance integrity in the delivery of products and services to government
institutions
v. Comply with all government of Kenya laws and regulations.
vi. Protect and respect third-party intellectual property and utilize it only after
having properly secured rights to its use.
d. Certified copies of the shareholders' certificatesof the company;
e. In the caseofatrust, acopy oftrustdeed
f. Audited financial statements of the person or firm for the period immediately
preceding theapplication and/or recent certified bank statements.
g. Certified copiesof the identity documents of the principal or principals ofthefirm;
67
h. In thecaseof a foreign contractor-proof ofcurrent registration statusfrom their country

of domicile ororigincertified by a local commissioner oaths. The registration of a
foreign contractor shall be guided by the relevant government policies.
i. Sufficientproofoffinancial capabilityofthe contractor; (f). proof of registration
withanassociation ofcontractors;
j. Suppliers / Contractors shall provide tax compliance certificates
ii. Proof ofemployment ofqualified persons bythe contractorandinthe case ofanapplication

relating tospecialized software, a certified copy of the current licenseissued by the relevant
statutory regulatory orAuthority ororganization.
iii. Proof of competent directors and technical staff as evidenced by IT related certificates,
project management certificates, professional certificates, national IDs and KRA pin
certificates.
iv. If an applicationin relationto this standardis made electronically,allsupporting documents shall

be attached.
v. Local purchase orders shall be provided as proof of projects undertaken in the area of
specialization applied for.
vi. An application shall not be considered dulycompleted forpurposes of this regulation, unless
all documents arereceived by the Authority.
vii. The Authority shall make adecision onanapplication bya person or firm within thirty days
of receiving such application including rejection if such person does not fully
comply with requirements set by the Authority, and shall inform the applicant
accordingly giving reasons forsuchrejection.
viii. Anapplication formforregistration maybemade inEnglish orKiswahili.
ix. A register of registered contractors shall be kept.
x. A person who qualifies for registration in a specialized area shall be issued with a
Certificate of Registration in the specialized area of ICT by the Authority.
xi. A person or firm shall submit an annual application for renewal of the
certificate of registration to the Authority in the prescribed form accompanied
by the prescribed fee (See scheduleB) and the Authority shall processthe application
in accordance with the provisions of the standard.
xii. A person who is aggrieved by the decision of the Authority in relation to the
category of registration may submit a written petition indicating the reasons
of such grievance, sufficient to justify review or the assessment by Authority.
xiii. The Authority shall within thirty days of receiving a petition under notify the
person of the Authority's decision on both applications.
68
xiv. Registration of contractors under ICTA - I (See schedule B) category shall be open to
both local and foreign contractors.
xv. Any registrations that fall between ICTA -2 to ICTA -8 as set out in the standard shall be
restricted to local contractors only.
xvi. A contractormay make an application for upgrading to theAuthority in a form to be

prescribed by the Authority accompanied by theprescribedfee, and the Authority
shallprocesstheapplication in accordancewiththeprovisionsofthe standard.
xvii. Application forrenewal of the licenseshall besubmitted tothe Authority inwriting at least thirty
days before the expiry of such license.
xviii. In each year during which acontractor holds a license, the contractor or, inthe case
ofafirm orcompany; thepartner who possesses technical qualifications, skills orexperience
shall attend at least one Continuous Professional Development event recognized by the
Authority and the Authority shall consider the attendances while determining
anapplication torenew orupgrade theContractor.
xix. During the vetting and verification of contractor’s documents, the Authority/representative
may visit contractor’s premise to ascertain the information provided.
xx. The Authority shall published list of contractors with valid licenses in their websites.
SCHEDULE B. CLASSIFICATION OF WORKS
Points Registration Fee (Ksh.) Annual Renewal

Fee(Ksh.)
Local Contractor
ICTA 1 85 – 100 30,000 10,000
ICTA 2 75 – 84 25,000 8,300
ICTA 3 65 – 74 20,000 6,600
ICTA 4 55 – 64 15,000 5,000
ICTA 5 45 – 54 12,000 4,000
ICTA 6 35 – 44 10,000 3,300
ICTA 7 25 – 34 5,000 1,600
ICTA 8 10– 24 2,500 830
Re-apply Below 10
Foreign Contractor
ICTA 1 75,000 50,000
ICTA 2
ICTA 3
ICTA 4
ICTA 5
ICTA 6
ICTA 7
ICTA 8
TOTAL
69
SCHEDULE C. ENFORCEMENT
i. There shall be payableto the Authority such fees for its services as the Authority may
determinefrom time to time.
ii. The Authority may remove the name or a contractor from the register of
contractorsifthe contractor has been debarred from participating in a procurement
process under any legislation or received written complaints from any government
agency in regards to the contractors’ performance;
iii. The registration of a contractor shall be suspended after investigations

into his conduct have been concluded and it is established that the
contractor has engaged in misconduct.
iv. Fails to comply with the provisions in regard to the payment of the fees;
v. The Authority shall conduct an inquiry in to theconduct or the
contractor before removing the name of the contractorfrom the register.
SCHEDULE D. Mandatory Requirements for the various Sections
REFERE PARTICULAR MAX REMARKS IMPLEMENTATION Score Max

NCE S POINTS GUIDELINE Awarde Score
d
A Directors’ 15 Technical  Degree (at least BSc 3 marks
Qualification Director
in Computer
and work [9 marks]
experience. Name: Science, IT or
related)
 Certification in 3 marks
Project Management
 Work experience in 3 marks
(3) similar
assignments as team
leader,1 mark per
assignment,
maximum score
Other  Work experience in 3 marks
directors (3) similar
6 marks
Name: assignments as team
leader,1 mark per
assignment,
maximum score
 Degree (at least BSc 3 marks
in Computer
Science, IT or
related)–
70
B Staff 25 Technical ii) Project team – at least 5

qualification staff in persons.
specialized
area (5 marks for each person)
[25 marks] Scoring is based on the
following.
 Degree (at least BSc
Computer Science, 10
/IT or related marks
 Professional 5 marks
certification
 Work experience in 5 marks

3 similar
assignments
 Certification in 5 marks
project management
C Financial 38 Turnover i) Turnover 14 Marks

status (financial  A high turnover (14
position/ marks)
balance  Average turnover (8
sheet) [14 marks)
marks]  Low turnover (5
marks)
Largest
projects in 14 Marks
area of ii) Specialization
Specializati -2 relevant
on [14 Project>100M
marks] (14MKs)
-2 relevant
project>50M (10
Mks)
-2 relevant
project>5M (6
mks)
-2 Projects <5M
(3 Marks)
Cash flow
71
[10 marks] iii) Cash flow 10 Marks

>100M in a
financial year (5
marks)
>50 M in a
financial year (3
marks
<50 M in a f/y (2
mark)
D Office and 2 Adequate i) Business permit 2 Marks

service office
facilities space [2
marks]
E Company 20 Details of Demonstrable capacity at 20 Marks
experience developme company level by providing
nt projects evidence of 5 relevant works
undertaken carried out for the last 5
in area of years, evidenced by copy of
specializati purchase order or contract
on and contact details, job
(max 5 completion certificates/
projects) Client
testimonials/contracts. (20
marks)
– 4 marks for each job
carried out in Kenyan
government institutions and
- 2 marks for each job
carried out in private
organizations
TOTAL 100
72
Appendix 34: Accreditation of ICT Professionals
1. REGISTRATION OF ICT PROFESSIONALS
Applicant should be compliant with the standard on ICT Human Capital and workforce
development, both ethically and in terms of professional qualifications in the area of
expertise. ICT Authority shall issue a certificate of accreditation on compliance with the
standard.
To commence the registration process, ICT Authority will register ICT Professionals according
to four categories of registration. The professional registrations category includes the
following:
a. ICT Professional
b. ICT Practitioner
c. ICT Graduate
d. ICT Technician
2. CODE OF PROFESSIONAL CONDUCT
Registered professionals and ICTA accreditation/certification holders shall:

1. Perform their duties with objectivity, due diligence and care, in accordance with
professional IT standards and procedures for effective governance and management of
Information and Communications Technologies.
2. Serve for public good in a lawful manner, while maintaining high standards of conduct and
character.
3. Maintain the privacy and confidentiality of information obtained in the course of their
activities.
4. Perform services only in areas of their competence
5. Inform appropriate parties of the results of work performed including the full disclosure of
all significant facts
6. Support the professional education of stakeholders in enhancing their understanding of the
governance and effective management of information and communications technology.
Failure to comply with this Code of Professional Ethics can result in an investigation into a
registered professional or accredited holder’s conduct and, ultimately, in disciplinary
measures including exclusion from the roll of IT professionals.
3. APPLICATION PROCESS
73
Step 1: Registration
Please visit the ICT Authority website www.icta.go.ke/standards/resources/ and check if you
meet the criteria for the registration category you wish to apply for, fill in details on the form
then submit to the ICT authority offices. Pay the registration fee as tabulated below;
REGISTRATION FEES ANNUAL FEES
ICT TECHNICIAN 600 500
ICT GRADUATE 1000 1000
ICT PRACTITIONER 2000 1000
ICT PROFESSIONAL 5000 3000
Table 1:- Registration of ICT professionals

In case of any difficulties or in need of more details please contact us via email
standards@ict.go.ke
Step 2: Assessment Evaluation
ICT Authority will conduct an evaluation of your application to make the decision on whether
your application is successful or not. You will be notified within 60 days of application on the
application evaluation decision. The ICT Authority may contact individual’s referees to
ascertain the information filled in the applicant’s application form.
REGISTRATION FORM
PERSONAL INFORMATION
Personal Details Surname
Other Names
ID Number
Date of birth
Gender
Telephone
Email
Home Address Town/City
Address
Postal code
Country
74
Residence
Details of Employer Employer Name
Telephone
E-mail
Details of Contact Person Name
Telephone
E-mail
MEMBERSHIP CATEGORY Requirements Select Category
ICT Technician Application fee: Ksh. 600

Form:(ICTA/STD/TECH/F001) Annual subscription:Kshs.500
Submit
 A duly filled Registration
Application form for ICT
Technician
(ICTA/STD/TECH/F001) and signed
Code of Conduct
(ICTA/STD/PROF/F005)
 Diploma certificate in
ICT/Engineering related field from
accredited institution of learning;
or Diploma certificate in any field
from accredited institution of
learning with proof of two years’
experience practicing ICT;
 Copy of National ID/Passport.
 Fees as above.
ICT Graduate Application fee: Ksh. 1000
Form: ICTA/STD/GRAD/F002 Annual subscription:Kshs.1000
Submit
 A duly filled Registration
Application form for ICT
Technician
(ICTA/STD/TECH/F002) and
signed Code of Conduct
 Graduate certificate in
ICT/Engineering related field
from accredited institution of
higher learning
 Copy of National ID/Passport.
 Fees as above.
ICT Practitioner Application fee: Ksh. 5000
Form:(ICTA/STD/PRACT/F003) Annual subscription: Kshs.1000
Submit
 A duly filled Registration Application
75
form for ICT Practitioner

(ICTA/STD/PRACT/F003) and signed
Code of Conduct
 Proof to show that the applicant has been
practicing ICT either through employment
or private engagement for at least 2
years.
 Copy of National ID/Passport
 Fees as above.
ICT Professional Application fee: Ksh. 5000
FORM:(ICTA/STD/PROF/F004 Annual subscription: Kshs.3000
)
Submit
 A duly filled Registration Application
form for ICT Professional
(ICTA/STD/PROF/F004) and signed
Code of Conduct
 Graduate certificate in
ICT/Engineering related field from
accredited institution of
Higher learning or A Copy of the
Registration Certificate for either ICT
Graduate/Practitioner from ICTA.
 Professional Certificate in the specific
area from recognized institution by
ICTA/government body
 Letters of reference from employer(s)
covering the previous two years
confirming professional integrity
 Statements of two referees detailing
their knowledge of the applicant.
 Fees as above.
4. Continuous Professional Development (CPD)

CPD is defined as the undertaking of development activities that lead to the
systematic maintenance, improvement and broadening of knowledge and skills,
and the development of personal qualities necessary for the execution of
professional and technical duties throughout a person`s ICT professional
career.
CPD Requirements
76
a) Certified Professionals (CP) must complete 90 CPD hours over a period of

three years.
b) Members shall demonstrate commitment to professional development via
written evidence of CPD activities.
c) Sources of CPD
 Attend conferences, seminars, training courses, presentations.
 Present papers at conferences and seminars, write articles for
journals (Contributions to knowledge)
Appendix 35: Government ICT Project Governance Structures

A. National ICT Project Governance Structures
Name of Membership Terms of Reference
Commit.
1 The ICT His Excellency the President –Chair Review and approve projects for
Oversight initiation
Committee Members
To provide oversight of flagship
Cabinet Secretary-; ICT Projects
Ministry of Land Housing & Urban To receive and consider reports
Development from inter-ministerial Steering
Ministry of interior and Coordination Project Committee
Ministry of Education Science and Technology
Ministry of ICT To resolve inter-ministerial
Project challenges.
Ministry of Devolution and Planning
Ministry of National Treasury Appointing Authority: H.E. The
President
Chief Executive Officer , ICT Authority-
Secretary Meeting : Bi-annual
2. Inter- Principal Secretary Ministry of ICT – Chair 1.Champion Implementation of

Ministerial Key Projects
Project Members
Steering 2. Monitor and Evaluation Projects
Permanent Secretary -; and take necessary action for the
Committee Ministry of Lands, Housing and Urban success of the project.
development The National
Treasury Ministry of 3. Prepare and report Projects
interior and Coordination status to oversight Committee
Ministry of Education Science & Technology
Ministry of Devolution and Planning 4. Resolve inter-ministerial
Chief Executive officer , ICTA –Secretary Project challenges.
5. Receive and review quarterly
reports from Project
Implementation and Monitoring
Committee. 6.
77
Co-opt the ministry that own the

key project(s)
Appointing Authority: H.E.The

President
Meetings: Quarterly
B: Ministries, Agencies and Counties
1.0 Project Implementation and Monitoring/Steering Committee
Role Person Terms of Reference
Project champion A top-ranking officer from the organ Initiate projects within Ministries,
(Chair) Agencies & Counties
Ps for Ministry and CEO for Agencies
Review and approve project concepts
and implementation plans
Project owner The user of the system Resolve project challenges to ensure
smooth implementation
Chair of Technical This is the person who is responsible
Review and approve project budget
committee for the implementation of the system.
Monitor and evaluate projects at
[Head of ICT] implementation stage
Project Management Project Manager ICT Authority Prepare and present quarterly
Office progress report to inter-ministerial
project Steering committee
Appoints Project implementing

team[s]
Co-opt stakeholder’s representatives

or other members
Meetings: Regularly
Appointing Authority: Cabinet

Secretary/Governor/CEO
appropriately
2.0 Project Technical Committee
Role Person
Project owner and Chair The user of the system
Project manager (Secretary) The person who is responsible for the execution of the project
78
Beneficiaries representative Stakeholder’s representative(s)
PMO Liaison officer An officer from the ICTA PMO
Consultant / Systems integrator Representative(s) of any third party who is involved in the
development of the project
Standard Liaison officer A Standard officer from ICTA
Technical liaison Selected technical expert(s) in line with the technical

requirements of the project
Appendix 36 Audit for outsourced applications

MCDA has;
a) Defined a strategy on how acquisition will be conducted.
b) Prepared a request for the supply of a product or service that includes the requirements.
c) Communicated the request for the supply of a product or service to potential suppliers
d) Selected one or more suppliers.
e) Developed an agreement with the supplier that includes acceptance criteria.
f) Identified necessary changes to the agreement.
g) Evaluated the impact of changes on the agreement.
h) Negotiated the agreement with the supplier.
i) Updated the agreement with the supplier, as necessary.
j) Assessed the execution of the agreement.
k) Provided data needed by the supplier and resolved issues in a timely manner.
l) Confirmed that the delivered product or service complies with the agreement.
m) Provided payment or other agreed consideration.
n) Accepted the product or service from the supplier, or other party, as directed by the
agreement.
o) Closed the agreement.
79

IT Governance Standard-Second Edition.

Uploaded by

Copyright:

Available Formats

IT Governance Standard-Second Edition.

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IT Governance Standard-Second Edition.

Uploaded by

Copyright:

Available Formats

GOVERNMENT ICT STANDARD ICTA.5.

IT Governance Standard (ICTA. 5.002.2019)

© ICTA 2019- All rights reserved Second Edition 2019

REVISION OF ICT STANDARDS

©ICT Authority 2019

ICT AUTHORITY (ICTA)

Document Name Government IT Governance Standard

Prepared by: Government IT Governance Technical Committee

Edition Second Edition

Approved by Board of Directors

Next Review Date After 3 years

7.5IT Continuous service improvement .............................................................. 14

Appendix 11GoK Project Management Governance Structure.................................... 30

Paul Kiprono Rono,

IT Governance is not a one-time exercise or something achieved by a mandate or set of rules. It

1.1 Description of standard

4. Terms and Definitions

5.1. Business Architecture

5.1.1 Business plans and objectives

5.1.2 Business Process

5.5 Security and Compliance

5.6 Project Management and Governance Architecture

5.7 Performance Architecture

5.7.1 Capability Maturity Model Integration (CMMI)

5.7.2 Balanced Scorecard

6.0 ICT Governance

a) An IT Strategy committee to provide strategic advice on ICT initiatives and investments

7IT Service Management

7.1.2 IT Service management

7.2 Service level management

7.2.2 IT Operations Control

7.2.3 Business Relationship Management

7.3 IT Service Design

7.3.2 IT Infrastructure Capacity Management

7.3.3 Information Security Management

7.3. 4Supplier management

7.4.2 Knowledge management

8 Legal and Regulatory

8.2 Roles and responsibilities

9ICT Risk management

10 Sourcing, Resourcing, and Financing of IT functions

a) MCDAs shall establish a resource centre for IT research and innovation

Appendix1: Compliance Checklist for Enterprise Architecture

Enterprise Architecture when developing their

as defined in the GEA

Appendix 2: Compliance Checklist for ICT Governance

MCDA has prepared and maintained an ICT strategic

Appendix 3: Compliance Checklist for IT Legal and regulatory

Legal and Legal and Regulatory YES/NO Comment

Kenya laws on ICT

Computer Misuse and Cybercrime Act 2018 -

Access to Information Act 2016- E-records,

Kenya Information and Communications Act

Evidence Act 2014- E-records and Data

Legal Notice 183, 2013 ( The Information and

Public Archives and Documentation Service

Industrial Property Act 2001 and Copyright

Public Officers Ethics Act 2003- End-user

NEMA guidelines on E-waste- End-User