1.0. BACKGROUND TO THE M & E EXERCISE
In line with the assigned mandate of NeGSt and her role as Technical Consultants to the Interior Ministry on the on-going eImmigration project, this Guide to the project Monitoring and Evaluation exercise is designed to equip the Assessor with the finer details, definitions and expected performance standards of the end-to-end Visa Biometric platform with a view to ensuring that the project is on track and functioning at optimal level.
Therefore, the M & E tool has been developed by NeGSt to evaluate the compliance level in relation to the expected results from the platform operation, focusing on the following key areas, namely: platform architecture, service delivery, platform protection, health/safety and security, preventive and breakdown maintenance, ease of doing business as well as continuous improvement. Of particular importance is the deliberate and escalating criminality in the cyberspace which is causing concern and through which sensitive data, money and identity are stolen recklessly in addition to acts of terrorism, blackmail and sabotage.
Proper attention will therefore be paid to the M & E exercise with a view to helping the platform to function optimally. The data collated from the exercise will form the basis for identifying gaps, improve the effectiveness and efficiency of the platform and ultimately ensure quality service delivery and continuous improvement. The exercise will also result in the creation of baseline historical data in hard copy useable for oversight activities and overall service improvement. The exercise will cover Service Providers’ workshops, Visa Application Centers (VACs) and the Nigerian foreign Missions.
1.1. VAC INVENTORY RECORD
The Assessor must document the Equipment description, type/model, asset No. and state-of-use of all inventory items including the available operations and/or training manuals and controls implemented at the VAC.
1.2. VAC HEALTH/SAFETY & SECURITY ANCILLARIES
This requirement is to ascertain that VAC inventory, health, safety and security items and consumables are documented and have been placed at appropriate locations in the VAC with a view to ensuring that Visa applicants, equipment, asset and personnel are adequately protected. The Assessor must see measures in place to prevent damage, injury, fire and any form of interference in VAC operations. The Assessor must also see that the VAC address, exit or escape routes are conspicuously displayed in aid rescue operations during fire or emergency situations. Assessor must request a demonstration of fire, safety, health and security measures in place as well as ascertain their adequacy and effectiveness.
Also, the Assessor must confirm that there are measures in place to prevent unauthorised access, damage, theft and interference with VAC premises and asset. This is important because any unauthorised access may compromise sensitive data and information processing facilities.
The Assessor must ensure that such measures are documented and known to all VAC personnel.
1.3. VAC BIOMETRIC EQUIPMENT
The Assessor must demand and see a documented Operations Manual of the Visa Biometric equipment, including procedures for addressing incidents, escalation procedure and a listing of primary and/or secondary personnel to contact when there are issues with the installed biometric equipment or supporting hardware e.g. equipment malfunction, equipment replacement, component replacement, equipment downtime etc. Where no such plan exists, the Assessor must make a note and call the attention of the Service Provider to the lapse. Where remediation is not effected during subsequent visit, such should be brought to the attention of the Project Owner and Platform Operator.
1.4. VAC PERSONNEL RECORD
The Assessor must document the name, position/role, age, qualification and experience of VAC personnel, including as much as possible ascertaining their language proficiency and comportment to render quality service to Visa applicants. Assessor must bear in mind that VAC personnel are the first point of contact with Nigeria and the impression conveyed to the applicant at that stage matters much to the image of Nigeria.
1.5. SERVICE PROVIDER WEBSITE
This requirement is to determine the operational and functional efficiency of the Service Provider’s website. The Assessor must navigate the website to check the under listed functionalities namely: friendliness, availability, security, look and feel, information reliability, completeness, responsiveness and load time, contact information, ease of navigation, FAQ content, hyperlinks
(broken or intact), search engine optimisation, self-service feature, feedback mechanism etc. The Assessor may choose not to conduct this assessment on site. He must however obtain the URL to the website and complete the assessment before turning in his report. Assessor must note that the website is the first point of contact for both applicants and hackers. For this reason, Firewall protection level one is a sine qua non.
1.6. Website Security Record
Assessor must dwell, in a pedantic manner on any security measures put in place to detect false pretence (419) application(s), picture trick(s), face swapping and/or manipulation(s) within the system . Ideally, there must be illegal content blocking and objectionable content interception measures in place. If none exits, the Assessor must escalate the lapse and have it corrected.
1.7. VAC PAYMENT PLATFORM
This requirement is to demonstrate that the payment system meets the highest compliance level required for any bespoke payment platform in terms of security. Due to the sheer quantum of transactions handled on annual basis that pass through the platform, it is important to avoid security breach that may result in account compromise and loss of revenue.
This requirement therefore demands that the payment platform must meet the recommended Compliance Level 1. In view of this, the Assessor must demand evidence of the yearly on-site reviews conducted by a certified Internal Auditor as well as network scan conducted by a certified Scanning Vendor. These are proofs that the payment platform has met the highest PCI DSS compliance level. There must be evidence also that communication on the platform is done via HTTPS with TLS 1.2 (Transport Layer Security). In a situation where the payment platform does not conform to Level 1 standard, the least requirement acceptable will be Level 2.
In this case, there must be proof of quarterly network security scan by a certified scanning vendor. Where Level 1 has been provided, evidence of a completed yearly Self-Assessment Questionnaire is enough proof that the platform has undergone a network security scan by a certified Scanning Vendor. However, NeGSt must insist for the Service Provider to meet the recommended Level 1 compliance.
This requirement is to assess and ascertain that the Service Provider has put in place an effective and efficient customer support mechanism to register, document and address all payment related transactions, including associated frauds, questions, double charges, issues, complaints, queries, enquiries etc. The customer support must be a multi-channel platform that includes web, email, SMS and phone. The system must provide 24/7 support services and must have in place Service Standards which clearly state how long it will take for issues to be resolved, service expectations and service performance indicators.
The Customer Support System must have a log of issues, date of occurrence or report, how it was resolved and the customer’s evidence of successful resolution. The Assessor must be able to verify the effectiveness of this system and see a demonstration of the system in use.
There is also a requirement to ensure that applicants pay only statutory and/or authorized charges and thus prevent extreme profiteering at VAC locations. Extra charges for photocopying, Executive reception, etc. may not be allowed unless authorized by the Project Owner.
2.0. VAC HELP DESK OPERATION
This requirement is to determine that the VAC has in place mechanism to address enquiries, complaints, minor issues or feedback from applicants. The Assessor must demand to see the Help Desk System in operation, comportment of the officer in charge, language options available, issues resolution mechanism or escalation procedure etc. The Assessor must determine whether or not the help desk operation is accessible via different modes: phone, email, SMS, website etc. Assessor must request a demonstration to ascertain availability and effectiveness.
3.0. INSTALLED SOFTWARE SECURITY RECORD
The activity of hackers and cyber criminals will pose a serious threat to any of the electronic devices having a weak security protection. Not only is the Assessor required to ensure that each device connected to the new automation process has best-in-class security protection, they must also go behind the screen and check regularly to ensure they are not compromised.
As the scope of vulnerable attack surface is expanding exponentially with the growth of malicious hacking technology the Assessor must carefully document every surface area through which a successful or failed attack occurred as well as the actions taken to stop, correct or forestall future attacks. The Assessor must therefore insist on a documented security protection protocol, attack statistics, testing procedure, when attacks happened, how they happened and where they happened. An audit trail of such events is a useful tool to prevent future attacks.
