Germany Country Report - Enisa - Europa

NIS awareness at the country level
Germany Country Report
Training and awareness programmes and initiatives under the CIP Implementation Plan
of the National Plan for Information Infrastructure Protection
In order to increase awareness with respect to the importance of IT security, German operators of
critical infrastructures have embarked on cross-sector cooperation with organisations of the public
administrations, such as BSI, the Federal Criminal Police Office, the Federal Network Agency and
the specialist ministries in charge. Joint exercises are held, such as the crisis management
exercise across federal states, Länderübergreifende Krisenmanagement Exercise (LÜKEX).
Awareness actions on emerging topics – cloud computing security requirements
In September 2010, the German Federal Office for Information Security - Bundesamt für
Sicherheit in der Informationtechnik (BSI) released a draft framework paper on information
security issues related to cloud computing. The draft paper defines minimum security
requirements for cloud solution service providers, and provides a basis for discussions between
service providers and users. The paper addresses the following issues:
� The definition of cloud computing
� Service provider security management requirements
� ID and rights management
� Monitoring and security incident response
� Emergency management
� Security checks and verification
� Requirements for personnel
� Transparency
� Organizational requirements
� User control
� Portability of data and applications
� Interoperability
� Data protection and compliance
� Cloud certification
� Additional requirements for public cloud service providers that support cloud solutions for
the German Federal Administration.
The BSI‟s goal is to work with stakeholders to develop appropriate security requirements that
should be considered with respect to the provision of cloud services. A consultation was open on
the above with service providers and users have, to review the paper and provide comments. The
final version is expected for 2011.
Awareness actions targeting the consumers/citizens
The BSI für Bürger (BSI for the public) provides in cooperation with the BKA information about
relevant NIS topics of interest for the citizens, such as how to prevent illegal traffic on website,
general rules and laws around the Internet 46 .
Also, on the Bürger-CERT platform, members of the public and responsible staff in small
companies can receive information regarding viruses, worms, and other computer security risks.
46 See: https://www.bsi-fuer-buerger.de/cln_030/ContentBSIFB/SicherheitImNetz/RechtImInternet/recht.html
23