Racism in Australia Essay Example | Topics and Well Written Essays - 1500 words - 2

Racism in Australia - Essay Example A massive collection of literature now states publicly that Australia is post-colonial; however, it cannot yet be illustrated in this manner although it does have a number of post-colonial components. Ken Gelder and Jane Jacob’s modern ‘Uncanny Australia: Sacredness and Identity in a Postcolonial Nation’, for instance, conceives Australia as post-colonial and determines the current wave of racism as postcolonial racism. However, this conception will no do, for it represses understanding that Australia is in several manners still a colonial society (ibid, 98). The concept of postcolonial may submit to an analysis of colonial structures of power and discourse, or, when portraying a form of society, then to those previous colonies, such as Malaysia, India or Indonesia, that achieved political sovereignty after the Second World War. Yet in connection to migrant societies such as Australia and New Zealand there is no equivalent or definite instance of decolonization. From the perspective of the aforesaid postcolonial societies, Australia is, to borrow Theresa Millard words, â€Å"the last country in the region to be decolonized, the place where the story didn’t end happily, where the colonizers didn’t go home† (Docker & Fischer 2000, 32) Racism is a significant and yet wide-ranging societal dilemma. It has assumed specific forms in societies such as Australia and New Zealand, where substantial flow of immigration and the multicultural foundation of current immigration regulation has led to progressively more racially diverse populations. In the contemporary period, racism in Australia has been mainly talked about during the supposed race debates in the latter part of the twentieth century, related to the ascendance of Pauline Hanson and her One Nation Party. On the other hand, the investigation of racism in the 1990s has been pioneered by cultural

DYNAMIC AIRCRAFT Assignment Example | Topics and Well Written Essays - 1000 words

DYNAMIC AIRCRAFT - Assignment Example First and foremost, Mr. Marshall got the wire specifications that the engineering department demanded for. He did this while ensuring that the engineers did not see the move as a way to censure them from specifying only one source. The engineers indicated that they required a special wire that could withstand very high temperatures hence the reason for their choice of Advanced Wire as the most appropriate source. According to Mr. Marshall, it was paramount for the engineers to indicate which type of specification to the supply manager since it was a rule in the company. Expecting to receive the governing specifications from the engineers, Mr. Marshall got samples of Advanced Wire’s ceramic-coated wire as well as its price quotations. This confirmed his fears as the prices were relatively higher than the industry averages although the ceramic-coating indeed made it be more expensive. The specifications from the engineers were of military standard type but the performance requir ements did not particularly specify that the wire had to have ceramic-coating. With this in mind, Mr. Marshall invited quotations from other suppliers who could meet the performance requirements with emphasis put on their prices and whether their samples met the specifications needed. Some five more suppliers were interested in providing the wire. The other suppliers submitted their price quotations and samples to Mr. Marshall who forwarded the samples to the production development laboratory for evaluation and analysis. The laboratory submitted its findings a week later which primarily focused on the ability of the samples to withstand high temperatures for long periods of time; the fundamental specification required by the engineers. One of the samples failed to meet the stipulated performance specifications but the other five samples exceeded the minimum performance requirements. The Advanced Wire’s sample was in fact more superior to the other sample in regards to its abi lity to withstand extremely high temperatures. The tests done on the weight of the samples, which was another important metric, showed that the wire supplied by Advanced Wire was considerably heavier than the other samples. Moreover, the conductivity attributes of Advanced’s wire was also relatively inferior compared to the other wires which exceeded the minimum performance specifications and were therefore acceptable. Furthermore, the abrasiveness test revealed that the wire supplied by Advanced Wire was less durable than the other wires by the other companies despite it passing the minimum performance tests. Armed with all this information, Mr. Marshall had the belief that indeed the engineering department might have got it wrong by stating that Advanced Wore had the best wire in the market. A fact proven wrong by all the tests performed which showed that other companies had superior products which met the governing military specifications that the engineers needed. Althoug h the wire by Advanced Wire was the most superior in reference to the ability to withstand heat owing to its ceramic-coating, it still did not justify the higher price quoted by the company. Other suppliers also met the specifications submitted by the engineers with a considerably lower price offered. Easternhouse Electric Company had the lowest asking price for the wire with a difference of $20,346 between it and Advanced Wire’

The Role of NCAA in the Rise of Intercollegiate Athletics Assignment

The Role of NCAA in the Rise of Intercollegiate Athletics - Assignment Example NCAA membership at the national office performs the role of assisting the underlying institutional members from diverse universities and corresponding colleges in comprehending different fundamental legislation of the NCAA. It majorly offers easier accessibility of the knowledgeable workers found within NCAA to the institutions and the public. The organization also organizes numerous workshops and educational conferences annually in an attempt to attain its institutional membership (Rader, 2009). NCAA membership services aid in managing and operation of the institutional athletes in connections with the federal legislation. It's linked with the federal government aid NCAA in examining of the present laws and underlying legislation. Â  NCAA is also charged with the organizing of the Youth Sports Programs at the national level thus enabling the disabled youths to access education and take part in the participation process annually. It also participates in numerous outreach activities that aid in the promotion of the underlying athletes’ administration thus offering equal opportunities of participation to its members notwithstanding of the race and ethnic. Organization of the NCAA provides scholarship programs to the student-athletes that encompass both undergraduate and degree programs to those who desire to learn while training. The programs that are normally offered by NCAA mainly entail instituting of the competition and impartial regulations for diverse sports as well as developing and maintaining of fundamental sports records and corresponding athletes historical statistics. Moreover, NCAA membership is mainly charged with the handling of the recruitment malpractices, competitiveness, impartiality an d corresponding athletes’ educational performance.

Negotiation in China Research Paper Example | Topics and Well Written Essays - 1250 words

Negotiation in China - Research Paper Example   Many entrepreneurs have strived to make their ways in China with different investment intentions that include creating a partnership with Chinese firms. Negotiations are never easy since there are special insights that are required for proper negotiations processes. There exist a number of complications that hinder negotiations inChinaa which are largely based on the complicated Chinese culture. Better negotiation styles and skills are therefore very necessary in bringing competitive advantages and benefits. Chinese culture has very great influence on her business negotiations. China’s culture and behavior should be viewed differently by investors since the economics within Greater China become more internally linked together. To create competitive advantage among foreign investors going to china, there is a dire need to train them in international manners and customs so that they can learn a better negotiation style that is appropriate for China. The collectivism, hierarc hical, relationship and the haggling culture of Chinese people should be well understood particularly their long courting, formal and the fact that they prefer drawing on intermediaries when it comes to negotiation process. Dr. Robert Grosse authorized this research to further investigate the business managers’ perceptions regarding specific characteristics needed for successful negotiation in China. Dr. Robert B. Rogow, Dean of the College of Business and Technology at Eastern Kentucky University, will receive the finalized report on March 6, 2013.

UNIT 6 Essay Example | Topics and Well Written Essays - 500 words

UNIT 6 - Essay Example Peterson had a right of being informed of the plans to transfer his employment contract and the ownership of the station in advance. Peterson had a right to resign if he did not intend to extend his contract to Evening news but he will not have any right to claim for redundancy or unfair dismissal pay. If the working conditions in the new employer are worse, Peterson has a right to resign and claim for unfair dismissal pay. Peterson has a right to disagree with the transfer of his employment contract to a new employer. This is when the new employer wants to change the term of the contract, which had been agreed by Peterson and the previous employer. If the employers want to change the terms of contract for the benefit of Peterson, it will be allowed. If the new employer wants to dismiss or make any redundancy for technical or an economic reason, Peterson has a right to redundancy payment. The employer should not select Peterson for redundancy because he transferred from another compa ny. (Beatty & Samuelson, 2007) Peterson has a right to enforce the contract between Post-Network and evening News because he was not considered in the transfer of the Station to Evening News yet he had signed a binding agreement with Post-Network as an employer for three years. It is not ethical for Evening News to prevent Peterson from changing job to work for the competing station because Peterson had informed them early of his plan to resign. In addition, Peterson had not entered into any contract with Evening News, as the contract was not changed during the transfer of the station. The previous employer of the transfer did not inform Peterson. Post-Network had a right to transfer the station but should have informed Peterson through a letter in advance that the station is transferred such that Peterson can decide whether to work for the new employer or not. Collateral contract is whereby parties to a contract enter in to more than two

Aramco and British Petroluem Essay Example | Topics and Well Written Essays - 5000 words

Aramco and British Petroluem - Essay Example Saudi Aramco or Aramco is the national petroleum and natural gas company in Saudi Arabia. As per the reports, the company holds the largest crude oil reserves as well as the highest daily oil production capacity in the world. Observing such large scale operations, in 2015, Forbes magazine has facilitated Saudi Aramco as the largest oil and gas company in the world. Considering British Petroleum Plc, it is one of the six largest oil and gas companies in the world. This vertically integrated London based company concentrates on all segments of oil and gas industry ranging from exploration of energies to its production, refining and distribution in the global markets. From the company brief, it is evident that these two holds a very important position among the few companies in global oil and gas industry. Therefore, analyzing the internal operational techniques as well as global strategies related to corporate governance and leadership is definitely considered to be a critical task. Th erefore, for the purpose of analysis, the value chain and strength-weakness, opportunities-threats of these two firms will be evaluated and the corporate and global business strategies of these two companies will also be examined. In the next segment, global operational strategies of Saudi Aramco and British Petroleum will be analyzed in terms of Value Chain and SWOT analysis. The value chain defines a set of activities as identified by eminent strategist Michael Porter, analyzing which the company can recognize those factors that have enabled it to gain competitive advantage in the industry segment. Such factors can be categorized under primary and secondary activities. SWOT analysis helps an organization to identify the internal strength and weakness of the company as well as the opportunities and threats lying in its external environment. Saudi Aramco holds a very strong value chain depending upon which the company enjoys huge

An analysis of Information Security Governance in the Universities in Zimbabwe Essay Example for Free

An analysis of Information Security Governance in the Universities in Zimbabwe Essay Abstract The complexity and criticality of information security and its governance demand that it be elevated to the highest organizational levels. Within a university setup, information assets include student and personnel records, health and financial information, research data, teaching and learning materials and all restricted and unrestricted electronic library materials. Security of these information assets is among the highest priorities in terms of risk and liabilities, business continuity, and protection of university reputations. As a critical resource, information must be treated like any other asset essential to the survival and success of the organization. In this paper the writer is going to discuss the need for implementing Information Security Governance within institutions of higher education. Further than that, a discussion on how to best practice Information Security governance within the universities in Zimbabwe followed by an assessment on how far the Zimbabwean universities have implemented Information Security Governance. A combination of questionnaires and interviews is going to be used as a tool to gather data and some recommendations are stated towards the end of the paper. Introduction Governance, as defined by the IT Governance Institute (2003), is the â€Å"set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly.† Information security governance is the system by which an organization directs and controls information security (adapted from ISO 38500). It specifies the accountability framework and provides oversight to ensure that risks are adequately mitigated as well as ensuring that security strategies are aligned with business and consistent with regulations. To exercise effective enterprise and information security governance, boards and senior executives must have a clear understanding of what to expect from their enterprise’s information security programme. They need to know how to direct  the implementation of an information security programme, how to evaluate their own status with regard to an existing security programme and how to decide the strategy and objectives of an effective security programme (IT Governance Institute, 2006). Stakeholders are becoming more and more concerned about the information security as news of hacking, data theft and other attacks happen more frequently than ever dreamt of. Executive management has been showered with the responsibility of ensuring an organization provides users with secure information systems environment. Information security is not only a technical issue, but a business and governance challenge that involves adequate risk management, reporting and accountability. Effective security requires the active involvement of executives to assess emerging threats and the organization’s response to them (Corporate Governance Task Force, 2004). Furthermore the organizations need to protect themselves against the risks inherent in the use of information systems while simultaneously recognizing the benefits that can accrue from having secure information systems. Peter Drucker (1993) stated: â€Å"The diffusion of technology and the commodification of information transforms the role of information into a resource equal in importance to the traditionally important resources of land, labor and capital.† Thus as dependence on information system increases, the criticality of information security brings with it the need for effective information security governance. Need for Information Security Governance within universities. A key goal of information security is to reduce adverse impacts on the organization to an acceptable level of risk. Information security protects information assets against the risk of loss, operational discontinuity, misuse, unauthorized disclosure, inaccessibility and damage. It also protects against the ever-increasing potential for civil or legal liability that organizations face as a result of information inaccuracy and loss, or the absence of due care in its protection. Information security covers all information processes, physical and electronic, regardless whether they involve people and technology or relationships with trading partners, customers and third parties. Information security addresses information protection, confidentiality, availability and integrity throughout the life cycle of the information and its use within the organization. John P. Pironti (2006) suggested that among many reasons for information security  governance, the most important one is the one concerned with the legal liability, protection of the organization’s reputation and regulatory compliance. With the university setup, all members of the university community are obligated to respect and, in many cases, to protect confidential data. Medical records, student records, certain employment-related records, library use records, attorney-client communications, and certain research and other intellectual property-related records are, subject to limited exceptions, confidential as a matter of law. Many other categories of records, including faculty and other personnel records, and records relating to the universitys business and finances are, as a matter of university policy, treated as confidential. Systems (hardware and software) designed primarily to store confidential records (such as the Financial Information System and Student Information System and all medical records systems) require enhanced security protections and are controlled (strategic) systems to which access is closely monitored. Networks provide connection to records, information, and other networks and also require security protections. The use of university information technology assets in other than a manner and for the purpose of which they were intended represents a misallocation of resources and, possibly, a violation of law. To achieve all this in today’s complex, interconnected world, information security must be addressed at the highest levels of the organization, not regarded as a technical specialty relegated to the IT department. Information security is a top-down process requiring a comprehensive security strategy that is explicitly linked to the organization’s business processes and strategy. Security must address entire organization’s processes, both physical and technical, from end to end. Hence, Information security governance requires senior management commitment, a security-aware culture, promotion of good security practices and compliance with policy. It is easier to buy a solution than to change a culture, but even the most secure system will not achieve a significant degree of security if used by ill-informed, untrained, careless or indifferent personnel (IT Governance Institute, 2006). In an interview the executive director and information security expert on IT Governance and cyber security with the IT Governance and Cyber Security Institute of sub-Saharan Africa, Dr Richard Gwashy Young has this to say â€Å"†¦remember in  Zimbabwe security is regarded as an expense not an investment† (Rutsito, 2012). Benefits of Information Security Governance Good information security governance generates significant benefits, including: The Board of directors taking full responsibility for Information security initiatives Increased predictability and reduced uncertainty of business operations by lowering information security-related risks to definable and acceptable levels Protection from the increasing potential for civil or legal liability as a result of information inaccuracy or the absence of due care. The structure and framework to optimize allocation of limited security resources Assurance of effective information security policy and policy compliance A firm foundation for efficient and effective risk management, process improvement, and rapid incident response related to securing information A level of assurance that critical decisions are not based on faulty information Accountability for safeguarding information during critical business activities. Compliances with local and international regulations will be easier Improved resource management, optimizing knowledge, information security and information technology infrastructure The benefits add significant value to the organization by: Improving trust in customer/client relationships Protecting the organization’s reputation Decreasing likelihood of violations of privacy Providing greater confidence when interacting with trading partners Enabling new and better ways to process electronic transactions like publishing results online and online registration. Reducing operational costs by providing predictable outcomes—mitigating risk factors that may interrupt the process The benefits of good information security are not just a reduction in risk or a reduction in the impact should something go wrong. Good security can improve reputation, confidence and trust from others with whom business is conducted, and can even improve efficiency by avoiding wasted time and effort recovering from a security incident (IT Governance Institute, 2004). Information Security Governance Outcomes Five basic outcomes can be expected to result from developing an effective governance approach to information security: Strategic alignment of information security with institutional objectives Reduction of risk and potential business impacts to an acceptable level Value delivery through the optimization of security investments with institutional objectives Efficient utilization of security investments supporting organization objectives Performance measurement and monitoring to ensure that objectives are met Best practices The National Association of Corporate Directors (2001), recognizes the importance of information security and recommends four essential practices for boards of directors. The four practices, which are based on the practicalities of how boards operate, are: Place information security on the board’s agenda. Identify information security leaders, hold them accountable and ensure support for them. Ensure the effectiveness of the corporation’s information security policy through review and approval. Assign information security to a key committee and ensure adequate support for that committee. It is critical that management ensure that adequate resources are allocated to support the overall enterprise information security strategy (IT Governance Institute, 2006). To achieve effective information security governance, management must establish and maintain a framework to guide the development and maintenance of a comprehensive information security programme. According to Horton, et al (2000), an information security governance framework generally consists of: An information security risk management methodology; A comprehensive security strategy explicitly linked with business and IT objectives; An effective security organizational structure; A security strategy that talks about the value of information both protected and delivered; Security policies that address each aspect of strategy, control and regulation; A complete set of security standards for each policy to ensure that procedures and guidelines comply with policy; Institutionalized monitoring processes to ensure compliance and provide feedback on effectiveness and mitigation of risk; A process to ensure  continued evaluation and update of security policies, standards, procedures and risks. This kind of framework, in turn, provides the basis for the development of a cost-effective information security program me that supports an organization’s goals and provides an acceptable level of predictability for operations by limiting the impacts of adverse events. In his article Kaitano (2010), pointed some characteristics of good corporate governance coupled with good security governance. These include and not limited to: Information security being treated as and organization wide issue and leaders are accountable. Leads to viable Governance, Risk and Compliance(GRC) Milestones It is risk-based and focuses on all aspects of security Proper frameworks and programs have been implemented It is not treated as a cost but a way of doing business Roles, responsibilities and segregation of duties are defined It is addressed and enforced by policy Adequate resources are committed and Staff are aware and trained It is planned, managed, measurable and measured It is reviewed and audited The overall objective of the programme is to provide assurance that information assets are protected in accordance with their value or the risk their compromise poses to an organization. The framework generates a set of activities that supports fulfillment of this objective. Principles for information security within the University In their article titled Information Security Policy: Best Practice Document, Hostland et al (2010) pointed out some guiding principles for information security within a university setup. The following are some of the principles they mentioned: 1. Risk assessment and management The universitys approach to security should be based on risk assessments and should be continuously done and the need for protective measures evaluated. Measures must be evaluated based on the universitys role as an establishment for education and research and with regards to efficiency, cost and practical feasibility. An overall risk assessment of the  information systems should be performed annually. Risk assessments must identify, quantify and prioritize the risks according to relevant criteria for acceptable risks. Risk assessments should be carried out when implementing changes impacting information security. Some recognized methods of assessing risks like ISO/IEC 27005 should be employed. Risk management is to be carried out according to criteria approved by the management at University. Risk assessments must be approved by the management and if a risk assessment reveals unacceptable risks, measures must be implemented to reduce the risk to an acceptable level. 2. Information security policy The Vice Chancellor should ensure that the information security policy, as well as guidelines and standards, are utilized and acted upon. He must also ensure the availability of sufficient training and information material for all users, in order to enable the users to protect the universitys data and information systems. The security policy should be reviewed and updated annually or when necessary, in accordance with principles described in ISO/IEC 27001. However, all important changes to universitys activities, and other external changes related to the threat level, should result in a revision of the policy and the guidelines relevant to the information security. 3. Security organization The Vice Chancellor is responsible for all government contact. The university should appoint CSO (Chief Security Officer). Each department and section should also be responsible for implementing the units information security. The managers of each unit must appoint separate security administrators. The Registrar Academics has the primary responsibility for the information security in connection with the student registry and other student related information. The IT Director has executive responsibility for information security in connection with IT systems and infrastructure. The Operations manager has executive responsibility for information security in connection with structural infrastructure. He also has overall responsibility for quality work, while the operational responsibility is delegated according to the management structure. The Registrar Human Resources also has executive responsibility for information security according to the Personal Data Act and is the controller on a daily basis of the personal information of the  employees. The Registrar Academics and Research Administration have also executive responsibility for research related personal information. Universitys information security should be revised on a regular basis, through internal control and at need, with assistance from an external IT auditor. 4. Information security in connection with users of Universitys services Prior to employment security responsibility and roles for employees and contractors should be described. A background check is should also be carried out of all appointees to positions at the university according to relevant laws and regulations. A confidentiality agreement should be signed by employees, contractors or others who may gain access to sensitive and/or internal information. IT regulations should be accepted for all employment contracts and for system access for third parties. During employment, the IT regulations for the universitys information security requirements should be in place and the users responsibility for complying with these regulations is to be emphasized. The IT regulations should be reviewed regularly with all users and with all new hires. All employees and third party users should receive adequate training and updating regarding the Information security policy and procedures. Breaches of the Information security policy and accompanying guidelines will normally result in sanctions. Universitys information, information systems and other assets should only be utilized for their intended purpose. Necessary private usage is permitted. Private IT equipment in the universitys infrastructure may only be connected where explicitly permitted. All other use must be approved in advance by the IT department. On termination or change of employment, the responsibility for termination or change of employment should be clearly defined in a separate routine with relevant circulation forms. The universitys assets should be handed in at the conclusion of the need for the use of these assets. University should change or terminate access rights at termination or change of employment. A routine should be present for handling alumni relationships. Notification on employment termination or change should be carried out through the procedures defined in the personnel system. 5. Information security regarding physical conditions IT equipment and information that require protection should be placed in secure physical areas. Secure areas should have suitable access control to  ensure that only authorized personnel have access. All of the Universitys buildings should be secured according to their classification by using adequate security systems, including suitable tracking/logging. Security managers for the various areas of responsibility should ensure that work performed by third parties in secure zones is suitably monitored and documented. All external doors and windows must be closed and locked at the end of the work day. On securing equipment, IT equipment which is very essential for daily activities must be protected against environmental threats (fires, flooding, temperature variations). Information classified as sensitive must not be stored on portable computer equipment (e.g. laptops, cell phones, memory sticks). If it is necessary to store this information on portable equipment, the information must be password protected and encrypted in compliance with guidelines from the IT department. During travel, portable computer equipment should be treated as carry-on luggage. Fire drills should also be carried out on a regular basis. 6. IT communications and operations management Purchase and installation of IT equipment and software for IT equipment must be approved by the IT department. The IT department should ensure documentation of the IT systems according to universitys standards. Changes in IT systems should only be implemented if well-founded from a business and security standpoint. The IT department should have emergency procedures in order to minimize the effect of unsuccessful changes to the IT systems. Operational procedures should be documented and the documentation must be updated following all substantial changes. Before a new IT system is put in production, plans and risk assessments should be in place to avoid errors. Additionally, routines for monitoring and managing unforeseen problems should be in place. Duties and responsibilities should be separated in a manner reducing the possibility of unauthorized or unforeseen abuse of the universitys assets. Development, testing and maintenance should be separated from operations in order to reduce the risk of unauthorized access or changes, and in order to reduce the risk of error conditions. On system planning and acceptance, the requirements for information security must be taken into consideration when designing, testing, implementing and upgrading IT systems, as well as during system changes. Routines must be developed for  change management and system development/maintenance. IT systems must be dimensioned according to capacity requirements and the load should be monitored in order to apply upgrades and adjustments in a timely manner as it is especially important for business-critical systems. Written guidelines for access control and passwords based on business and security requirements should be in place. Guidelines should be re-evaluated on a regular basis and should contain password requirements (frequency of change, minimum length, character types which may/must be utilized) and regulate password storage. All users accessing systems must be authenticated according to guidelines and should have unique combinations of usernames and passwords. Users are responsible for any usage of their usernames and passwords. Data Gathering A structured questionnaire adapted and modified from previous questionnaires used by Corporate Governance Task Force, (2004) was used as the main instrument to gather data. Of the total 13 universities in Zimbabwe, 9 managed to participate in this research. The questionnaires were completed by the Executive Dean, IT Director, Operations Manager or Chairperson for the department. Section I: Organizational Reliance on IT The first section was designed to help in determining the institution’s reliance on information technology for business continuity. Table 1: Characteristics of Organization Questions Scores/Frequency 0 1 2 3 4 Dependence on information technology systems and the Internet to conduct academic, research, and outreach programs and offer support services 9 Value of organization’s intellectual property stored or transmitted in electronic form 2 7 The sensitivity of stakeholders (including but not limited to students, faculty, staff, alumni, governing boards, legislators, donors, and funding agencies) to privacy 2 3 4 Level of regulation regarding security (international, federal, state, or local regulations) 1 4 3 1 Does your organization have academic or research programs in a sensitive area that may make you a target of violent physical or cyber attack from any groups? 5 1 2 1 Total score 1 9 6 7 22 Scoring: Very Low = 0; Low = 1; Medium = 2; High = 3; Very High = 4 Section II: Risk Management: This section assesses the risk management process as it relates to creating an information security strategy and program. Table 2: Information Security Risk Assessment Questions Scores/Frequency 0 1 2 3 4 Does your organization have a documented information security program? 2 5 2 Has your organization conducted a risk assessment to identify the key objectives that need to be supported by your information security program? 2 4 3 Has your organization identified critical assets and the functions that rely on them? 2 2 5 Have the information security threats and vulnerabilities associated with each of the critical assets and functions been identified? 2 4 2 1 Has a cost been assigned to the loss of each critical asset or function? 1 3 3 2 Do you have a written information security strategy? 2 4 2 1 Does your written information security strategy include plans that seek to cost-effectively reduce the risks to an acceptable level, with minimal disruptions to operations? 4 2 2 1 Is the strategy reviewed and updated at least annually or more frequently when significant changes require it? 2 3 3 1 Do you have a process in place to monitor federal, state, or international legislation or regulations and determine their applicability to your organization? 2 2 3 2 1 Total 10 16 26 14 16 Scoring: Not Implemented = 0; Planning Stages = 1; Partially Implemented = 2; Close to Completion = 3; Fully Implemented = 4 Section III: People This section assesses the organizational aspects of the information security program. Table 3: Information Security Function/Organization Questions Scores/Frequency 0 1 2 3 4 Do you have a person that has information security as his primary duty, with responsibility for maintaining the security program and ensuring compliance? 4 3 1 1 Do the leaders and staff of your information security organization have the necessary experience and qualifications? 5 2 2 Is responsibility clearly assigned for all areas of the information security architecture, compliance, processes and audits? 3 4 1 1 Do you have an ongoing training program in place to build skills and competencies for information security for members of the information security function? 2 2 3 2 Does the information security function report regularly to institutional leaders and the governing board on the compliance of the institution to and the effectiveness of the information security program and policies? 2 3 3 1 Are the senior officers of the institution ultimately responsible and accountable for the information security program, including approval of information security policies? 3 4 2 Total 16 17 14 7 0 Scoring: Not Implemented = 0; Planning Stages = 1; Partially Implemented = 2; Close to Completion = 3; Fully Implemented = 4 Section IV: Processes This section assesses the processes that should be part of an information security program. Table IV: Security Technology Strategy Questions Scores/Frequency 0 1 2 3 4 Have you instituted processes and procedures for involving the security personnel in evaluating and addressing any security impacts before the purchase or introduction of new systems? 2 3 3 1 Do you have a process to appropriately evaluate and classify the information and information assets that support the operations and assets under your control, to indicate the appropriate levels of information security? 1 2 3 2 1 Are written information security policies consistent, easy to understand, and readily available to administrators, faculty, employees, students, contractors, and partners? 2 3 3 1 Are consequences for noncompliance with corporate policies clearly communicated and enforced? 1 3 2 3 1 Do your security policies effectively address the risks identified in your risk analysis/risk assessments? 2 3 4 Are information security issues considered in all important decisions within the organization? 3 2 3 1 Do you constantly monitor in real time your networks, systems and applications for unauthorized access and anomalous behavior such as viruses, malicious code insertion, or break-in attempts? 1 3 3 1 1 Is sensitive data encrypted and associated encryption keys properly protected? 2 3 2 1 1 Do you have an authorization system that enforces time limits and defaults to minimum privileges? 2 2 2 3 Do your systems and applications enforce session/user management practices including automatic timeouts, lock out on login failure, and revocation? 2 3 2 2 Based on your information security risk management strategy, do you have official written information security policies or procedures that address each of the following areas? Individual employee responsibilities for information security practices 4 3 1 1 Acceptable use of computers, e-mail, Internet, and intranet 2 3 2 2 Protection of organizational assets, including intellectual property 2 2 3 2 Access control, authentication, and authorization practices and requirements 1 2 3 1 2 Information sharing, including storing and transmitting institutional data on outside resources (ISPs, external networks, contractors’ systems) 2 1 3 2 1 Disaster recovery contingency planning (business continuity planning) 1 1 3 4 Change management processes 2 3 2 2 Physical security and personnel clearances or background checks 1 3 3 2 Data backups and secure off-site storage 1 1 3 4 Secure disposal of data, old media, or printed materials that contains sensitive information 2 3 4 For your critical data centers, programming rooms, network operations centers, and other sensitive facilities or locations: 2 3 4 Are multiple physical security measures in place to restrict forced or unauthorized entry? 1 2 3 3 Is there a process for issuing keys, codes, and/or cards that require proper authorization and background checks for access to these sensitive facilities? 2 1 3 3 Is your critical hardware and wiring protected from power loss, tampering, failure, and environmental threats? 1 4 4 Total 17 45 58 50 47 Scoring: Not Implemented = 0; Planning Stages = 1; Partially Implemented = 2; Close to Completion = 3; Fully Implemented = 4 Discussion As shown by the total scores on Table 1, a majority of the university has a very high reliance on the IT in their services. This is depicted by the structure and characteristics of the university. Information risk assessment and management leaves a lot to be desired by the universities. Most the universities have partially implemented such programs. A large number of employees in the IT departments of most universities do no have sufficient skills to implement good information security governance. Most universities lack the leaders who have the rightful know how on the subject. In addition  to that, there is no a representative in the council who will be an IT expert, hence most leaders lack interest and initiatives on information security. Due to lack of full responsibility of information security by the leaders, to implement processes for information security might also be a challenge especially to the IT department as normally is the department given the responsibility. Conclusion There is a need for institutions to start focusing on proper information security governance. For a start organization such as the Government, the Computer Society of Zimbabwe, Zim Law Society, POTRAZ, ICAZ, IIAZ, Zimbabwe Institute of Management and other industry governing bodies should put their heads together and define the appropriate legislations that mandates information security governance either by referring to existing international frameworks (PCI-DSS, SOX, COSO, ITIL, SABSA, Cobit FIPS, NIST, ISO 27002/5, CMM, ITG Governance Framework) or by consulting local information security and business professionals to come up with an information security governance framework. As the Zimbabwean economy is slowly sprouting, the art of information security governance in the universities should also take a leap. The adoption information security governance will ensure that security will become a part of any university and thus customers confidence will be boosted. References Drucker, P. ‘Management Challenges for the 21st Century’, Harpers Business , 1993. Corporate Governance Task Force, Information Security Governance: Call to Action, USA, 2004. IT Governance Institute, Board Briefing on IT Governance, 2nd Edition, USA, 2003, www.itgi.org. IT Governance Institute, Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd Edition, USA, 2006. ISO/IEC 38500: Corporate Governance of Information Technology, 2008. IT Governance Institute, COBIT 4.0, USA, 2005, www.itgi.org IT Governance Institute, COBIT ® Security Baseline, USA, 2004, www.itgi.org National Association of Corporate Directors, ‘Information Security Oversight: Essential Board Practices’, USA, 2001 John P. Pironti,  Ã¢â‚¬Å"Information Security Governance: Motivations, Benefits and Outcomes,† Information Systems Control Journal, vol. 4 (2006): 45–8. 21. Rutsito, T. (2005) ‘IT governance, security define new era’ The Herald, 07 November. Kaitano, F. (2010) ‘Information Security Governance: Missing Link In Corporate Governance’ TechZim. http://www.techzim.co.zw/2010/05/information-security-governance-missing-link-in-corporate-governance [accessed 02 May 2013]. Horton, T.R., Le Grand, C.H., Murray, W.H., Ozier, W.J. Parker, D.B. (2000). Information Security Management and Assurance: A Call to Action for Corporate Governance. United States of America: The Institute of Internal Auditors. Hostland, K, Enstad, A. P, Eilertsen, O, Boe, G. (2010). Information Security Policy: Best Practice Document. Corporate Governance Task Force, (2004). Information Security Governance: Call to Action, USA