.

Cyber Law College has been a pioneer in the field of Cyber Law Education in the Country. In its continued bid to improve Cyber Law Compliancy in the Indian IT user segment,  it is introducing a first in the world concept of "CyLawCom Certification".

"CyLawCom" certification programme is meant for organizations using IT in their business process. It aims at establishing a practical and measurable standard for Cyber Law Compliance in the business process of the organization.

The need for "CyLawCom" certification is felt since the existing standards of quality drive in business processes namely the CMM and Six Sigma do not cover all aspects of Cyber Law Compliance before certifying an organization under their respective norms.

 Both CMM and Six Sigma principles are perhaps broad enough to include Cyber Law Compliance as one of the parameters of measurement but practically cannot immediately use Cyber Law Compliance as an essential criteria for certification. If all the "Cyber Law Non Compliance" is factored into the current CMM and Six Sigma Certifications, it is likely that all current certifications could be drastically over turned.

It is therefore necessary that "CyLawCom" is introduced as a complimentary certification so that existing certifications are not disturbed.

In order to high light this problem, let us take a few examples.

Example 1:

ABC is a software development company certified by CMM. It develops software for Hospitals for use in Singapore. The system includes electronic generation of prescriptions by a doctor who logs into the system using a password and log in ID.

In a country like India where electronic documents can be authenticated only through Digital Signatures, there would be a serious ethical question raised. This process would technically be equivalent to issuing a prescription without a legally valid signature. It means that the doctor cannot be held legally accountable for the prescription.

Quality Standard norms should debate if this factor should be considered as a lacuna in the development process and all such prescriptions are to be treated as "defects" generated by the system.

If so, the question arises if this non compliance of Cyber Laws in India should be a factor which should down grade the CMM or Six Sigma rating of the Company to which it is otherwise entitled.

Example 2:

XYZ develops a Banking software which amongst other features includes a feature by which automatic alerts are generated with some transaction particulars and mailed to the controlling office of the Bank.

The software is used in an EU country and the alerts flow into a foreign country not adopting the EU privacy norms.

The software does not use any specific "Acceptance" from the client for such transfer of private data out of the EU domain.

A question arises whether this should be treated as a "Defect" in the Six Sigma process since every such incident creates a potential liability for the user of the software and is caused by the feature in the software. 

If the development process was able to recognize such possibilities, then appropriate action to check such possibility and generation of an suitable  clause in the Customer agreement authorizing the same could have been generated at the development and testing process itself.

CMM should perhaps have factored such facts into its certification process.

Thus it is seen that CMM and Six Sigma processes at present are under tremendous strain to recognize the impact of dynamic set of laws that affect the clients using software. In most of the Countries, software is considered as an "Agent" of the user and hence the principal is accountable for all illegal activities of the Software even if it is out of ignorance.

It is the responsibility of quality controllers to guide the industry and help them maintain their desired standards.

"CyLawCom" is an attempt to provide such guidance through a Certification programme built around

Creating an Awareness of the Need for Cyber Law Compliance and putting the necessary system in place for automatic application of  Cyber Law Compliance to Business Processes.

  "CyLawCom" is meant to be complimentary to CMM and Six Sigma since both these programmes are not in conflict with "CyLawCom" and are in principle.

The recommended process of "CyLawCom" certification by Cyber Law College would be elaborated in a subsequent note.

Continuation Article

Naavi

January 20, 2003

(Comments are Welcome)