Governance, Security, and Responsible System Design

The timely and efficient delivery of public services often relies on complex integration of diverse digital systems. These systems, developed and operated by a myriad of organizational stakeholders, must work together reliably and as intended to ensure positive social outcomes. Consequently, resilient governance, security, and responsible design are essential for the successful delivery of such systems. Yet, although governance, security, and responsible considerations are often included in the planning and development of information and communications technology projects, the approaches and supporting frameworks are rarely integrated. This research develops an expanded foundation that covers governance, security, and responsible design for information and communications technology systems. Complementing addressing scholarly gaps, evidence-based analysis is useful for practitioners, as real-world case studies, comparative analysis, and architecture design patterns are also included.

Governance by design ensures that appropriate stakeholder engagement and accountability processes are integrated into the architecture of systems for public services. Such design can help avoid difficulties associated with determining whose actions, omissions, or decisions should be held accountable when public sector systems fail, misbehave, or are attacked. Security by design incorporates threat modeling and risk assessment; effective asset management and appropriate design, development, and operational processes; defense-in-depth; secure by default; and secure by design into information and communications technology. Responsible system design covers policy, ethical, and societal considerations; the decision to use artificial intelligence; and transparency, explainability, and user trust. Designing systems for public service that are secure, governed, and responsible by design increases the likelihood that resilient, trustworthy systems will be delivered.