ICT in the Public Service: Use, Security and Data Protection
Information and Communications Technology in the public service is about using digital tools safely, ethically, and accountably. The exam tests your knowledge of acceptable use, cybersecurity, digital records, and data protection. Public officers handle sensitive personal and official data; unauthorised disclosure, lost devices, weak passwords, and phishing can cause financial loss and reputational damage. The Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission provide the current data-protection framework, while each ministry, department, or agency's ICT policy sets acceptable-use rules.
Core rules and concepts
- Use official systems for official purposes; personal use must be minimal, lawful, and within policy.
- Protect credentials: use strong, unique passwords, enable multi-factor authentication where available, and never share passwords.
- Treat unsolicited links and attachments as suspect; verify the sender before acting.
- Store official records in approved systems, not personal email or unapproved cloud accounts.
- Back up critical data and report loss, theft, or suspected breach promptly.
- Personal data should be collected for a lawful purpose, kept accurate, secured, and disclosed only on lawful authority.
- ICT devices and accounts may be audited; users should have no expectation of absolute privacy on official systems.
Worked example
An officer receives an email claiming to be from the IT unit and asking for the officer's password to 'upgrade the mailbox'. The email has a shortened link and a sense of urgency. Reasoning: legitimate IT staff do not ask for passwords. The officer should not click the link, should report the message to the IT or security desk, and should change the password if it was already entered. The officer should also check the official ICT policy on reporting phishing. Deleting the email without reporting loses evidence.
Traps that cost marks
- Sharing a password because a caller sounds official.
- Using a personal email account for official records.
- Clicking first and verifying later.
- Assuming data protection only applies to banks or websites.
- Failing to report a lost device or suspected breach.