{"id":5261,"date":"2025-10-29T11:31:14","date_gmt":"2025-10-29T11:31:14","guid":{"rendered":"https:\/\/technology.ly\/en\/?post_type=webblog&#038;p=5261"},"modified":"2025-10-29T11:31:20","modified_gmt":"2025-10-29T11:31:20","slug":"nissa-cert","status":"publish","type":"webblog","link":"https:\/\/technology.ly\/en\/webblog\/nissa-cert\/","title":{"rendered":"The First IT Policy Compliance Certificate in Libya"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">As we continue to present the <em>Essays of the Foundation<\/em> \u2014 reflections from our team, management, and ideas \u2014 during <strong>Cybersecurity Awareness Month (October)<\/strong> each year, we consistently strive to take the initiative and to open new paths within our available means and capacities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In light of the growing wave of cyberattacks targeting Libya in recent years, we noted that the <strong>National Information Security and Safety Authority (NISSA Libya)<\/strong> had issued its public and advisory policies about six years ago, followed by the <strong>National Cybersecurity Strategy<\/strong> in <strong>February 2023<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s when the lightbulb went on.<br>Since many policies and strategies in Libya remain inactive \u2014 locked away in drawers and cabinets \u2014 we decided, in a pioneering and leading step, to take the initiative in <strong>May 2023<\/strong> to begin working toward compliance with the national standards and policies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And to be completely honest, the journey from <strong>May 2023<\/strong>, when we received the first questionnaire, until <strong>March 2024<\/strong>, was <strong>extremely difficult, exhausting, painful, and costly \u2014 in every possible way<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Referring to the point in the National Authority\u2019s strategy which emphasizes <em>\u201cpromoting awareness through all means\u201d<\/em>, and from our belief that we should lead by example by <em>implementing<\/em> the policies rather than just <em>promoting<\/em> them, we decided to pursue a <strong>Libyan Compliance Certificate<\/strong> \u2014 and sought the support of all our private-sector partners.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We encountered many challenges but managed to solve them faster than expected \u2014 a surprise even to us \u2014 which boosted our confidence that the goal was achievable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the authority\u2019s requirements was to <strong>raise staff awareness<\/strong>, and we found that <strong>Libyan Spider<\/strong> offered an awareness program developed by <strong>Kaspersky<\/strong>, which they generously provided to us free of charge as an in-kind contribution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We were also required to have a <strong>local backup<\/strong>, and <strong>Modern Systems Technology (MST)<\/strong> stepped in to provide us with the necessary equipment and servers.<br>For <strong>secure and dedicated internet access<\/strong>, including controlled permissions and access firewalls, we received support from <strong>Al-Hadatha for Communications and IT<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What truly saved both time and costs was the <strong>Microsoft 365 suite<\/strong>, which Microsoft had provided us free of charge several years ago \u2014 a contribution of great value. We then sought help from experts in Microsoft technical and security solutions \u2014 <strong>Tazamun Integrated Solutions<\/strong> \u2014 whose team dedicated their time and effort to implement:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Data Loss Prevention (DLP)<\/strong> measures,<\/li>\n\n\n\n<li><strong>Privacy policies<\/strong>,<\/li>\n\n\n\n<li><strong>System analysis<\/strong>,<\/li>\n\n\n\n<li><strong>Device ownership and identity security<\/strong>,<\/li>\n\n\n\n<li>and many other controls that raised our overall cybersecurity compliance score from <strong>40% to 72%<\/strong> \u2014 the highest possible rating.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This, of course, caused some discomfort and resistance to change among staff members, but they rose to the challenge responsibly and professionally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It was a massive effort involving numerous tasks, recommendations, and inevitable mistakes \u2014 from something as simple as a <strong>lock screen timer exceeding one hour (counted as a violation)<\/strong>, to <strong>encrypting backups<\/strong>, defining <strong>admin and user privileges<\/strong>, controlling <strong>paper printouts<\/strong>, <strong>securing sensitive documents<\/strong>, and ensuring <strong>off-site backups<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some people thought what we did was just a <em>marketing exercise<\/em> or <em>publicity stunt<\/em>.<br>No, dear reader \u2014 this was the result of <strong>the work of over 40\u201350 engineers, specialists, technicians, members, and consultants<\/strong>, verified through a <strong>300+ page audit manual<\/strong> from the Authority, and even <strong>on-site inspections<\/strong> where the auditors refused to drink our coffee or accept any form of courtesy hospitality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I still recall one particular session when I was asked to <strong>step out of the office<\/strong> so the auditors could interview our staff privately \u2014 to verify whether our statements matched our actual operations. It felt almost like an interrogation (haha).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To this day, we <strong>update our systems daily<\/strong> and <strong>stay ready for any unannounced visit<\/strong> from the NISSA team, who reminded us that our certificate is valid for <strong>three years<\/strong> \u2014 but may be <strong>revoked at any time<\/strong> if they find violations or breaches of the approved policies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are <strong>no weak passwords<\/strong> in our systems.<br>There is <strong>no pirated software<\/strong> on our devices.<br>No suspicious applications are allowed to enter our network.<br>We continuously update our systems and <strong>strive to meet the highest standards<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This does <strong>not<\/strong> mean we are immune to hacking, data loss, or service interruptions \u2014 but we hope we have risen to implement the <strong>strictest standards<\/strong> of the National Information Security and Safety Authority\u2019s policy manual, and we genuinely hope that many other institutions and companies in Libya will follow this path.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not underestimate the words <strong>\u201cInformation Security.\u201d<\/strong><br>They are not simple or cheap. The systems are not easy to implement, and <strong>raising awareness among employees \u2014 from the lowest level to top management \u2014 is an extremely costly process.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reaching this level of compliance was only possible through <strong>God\u2019s grace<\/strong>, and the <strong>support of our partners, members, and allies<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The success we achieved is satisfying \u2014 but maintaining it demands from us and our partners <strong>daily effort<\/strong>: continuous learning, updates, purchasing new equipment, developing software, and improving practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These simple reflections summarize the journey of the <strong>IT Unit at the Libyan Technology Foundation<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Until the next article \u2014<br>I salute you all and wish you success in your work, whatever your field may be.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As we continue to present the Essays of the Foundation \u2014 reflections from our team, management, and ideas \u2014 during Cybersecurity Awareness Month (October) each year, we consistently strive to take the initiative and to open new paths within our available means and capacities. In light of the growing wave of cyberattacks targeting Libya in [&hellip;]<\/p>\n","protected":false},"featured_media":4690,"parent":0,"template":"","meta":{"_acf_changed":false},"blog-categories":[37],"writer":[62],"class_list":["post-5261","webblog","type-webblog","status-publish","has-post-thumbnail","hentry","blog-categories-chairman-of-the-board-of-directors","writer-amin-salih"],"acf":[],"_links":{"self":[{"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/webblog\/5261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/webblog"}],"about":[{"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/types\/webblog"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/media\/4690"}],"wp:attachment":[{"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/media?parent=5261"}],"wp:term":[{"taxonomy":"blog-categories","embeddable":true,"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/blog-categories?post=5261"},{"taxonomy":"writer","embeddable":true,"href":"https:\/\/technology.ly\/en\/wp-json\/wp\/v2\/writer?post=5261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}