R&M Data Center Handbook

www.datacenter.rdm.com
• IT Baseline Protection
Since 1994, the Federal Office for Information Security (BSI) in Germany has been issuing the IT
Baseline Protection Manual, which provides detailed descriptions of IT security measures and
requirements for the IT security management.
In 2006 the manual was adapted to international standards, rendering it fully compatible with ISO/IEC
27001 while also incorporating the recommendations specified in ISO/IEC 27002.
ISO/IEC 27001 certification based on IT baseline protection can be applied for with the BSI.
Security Measures and Monitoring
The following standards deal with enhancing IT network security. IT network security is not restricted to internal
corporate networks, but also includes the security of external network access points. A selection of standards
follows below.
• ISO/IEC 18028 (soon 27033)
The objective of this standard is to focus on IT network security by specifying detailed guidelines aimed
at different target groups within an organization. It includes security aspects in the handling, maintenance
and operation of IT networks plus their external connections.
The standard comprises five parts:
1. Guidelines for network security
2. Guidelines for the design and implementation of network security
3. Securing communications between networks using Security Gateways
4. Remote access
5. Securing communications between networks using Virtual Private Networks (VPN)
• ISO/IEC 24762
This standard provides guidelines on the provision of information and communications technology
disaster recovery (ICT DR) services. It includes requirements and best practices for implementing
disaster recovery services for information and communications technologies, for example emergency
workstations and alternate processing sites.
• BS 25777:2008
The objective of this standard is to establish and maintain an IT Continuity Management system.
Risk Management
• ISO/IEC 27005
This standard provides guidelines for a systematic, process-oriented risk management system that
supports the requirements for a risk management in accordance with ISO/IEC 27001.
• MaRisk / MaRisk VA
The Minimum Requirements for Risk Management (MaRisk) for banks were first issued in 2005 by the
German Federal Financial Supervisory Authority (BaFin). They include requirements for IT security and
disaster recovery planning. In 2009 another edition was published, which was expanded to include
insurance companies, leasing and factoring companies (MaRisk VA).
Relevant Standards
• COSO
The COSO model was developed by the organization of the same name (Committee of Sponsoring
Organizations of the Treadway Commission). It provides a framework for internal control systems and
describes:
o
o
o
o
o
A method for introducing the primary components of an internal control system, e.g. the control
environment in a company
Risk evaluation procedures
Specific control activities
Information and communication measures in a company
Measures required for the monitoring of the control system
COSO is the basis of reference models like Cobit and facilitates their introduction.
Page 30 of 156 © 08/2011 Reichle & De-Massari AG R&M Data Center Handbook V2.0