Draft operational guidelines of digital india land records modernization programme (dilrmp) introduction

(Revenue Secretary Committee Report)





Chapter-5 (Section-B)
Data Security

Evaluating and implementing ISO/IEC 27001 and ISO/IEC 27002 security standards

1. For any Land Records Information System, asset safeguarding (that includes data security) and data integrity are important objectives. Regular assessments need to be carried out as to how well these objectives are being met. This is an Information System Audit function. Information system (IS) auditing is the process of collecting and evaluating evidence to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively and uses resources efficiently. Information system auditing must be carried out by an agency other than the implementing agency (which in most cases is the NIC) and holds necessary competency/accreditations. IS Audit is carried out by organizations empanelled by the Indian Computer Emergency Response Team (CERT-In), an organization that works under the auspices of the Department of Information Technology, Government of India. Carrying out of periodic (at least twice a year) IS Audit of a computerized land records management system is strongly advised. Such auditing will increase usability of computerized land records and bring in more confidence among institutional users, such as banks, who may base some of their decisions on these records.
1.1 It is recommended that State Governments/UT Administrations may strive to achieve ISO 27001 certification as regards the computerized land records system. CERT-In website (www.cert-in.org.in/ProgressiveSteps.htm) lists the progressive steps that a State Government/UT Administration may take to achieve this certification. The certification process can be set into motion as soon as even one component of the land records system, say the text-database has been put in production use.