IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.177 Security during relocation
Initiation responsibility: Head of IT Section
Implementation responsibility: Head of Organisation, Head of Site Technical
Service; Head of IT Section; IT Security
Management
Relocation of an office entails not only transporting furniture between sites
but also moving quite different data media (e.g. hard copies, diskettes,
magnetic tapes) and IT systems. While the move is going on, information, IT
systems and other material is taken out of the secure office environment and
transported by personnel who normally are not authorised to access it.
Especially where a large part of the organisation is affected by the move, the
risk of a certain amount of chaos can never be excluded and it is simply not
possible to have every removal crate watched at all times Nevertheless, care
must be taken that sensitive data does not get lost, damaged or fall into the
hands of unauthorised persons during the move.
When planning the move, IT Security Management and the Data Privacy
Officer should be involved as early as possible so that they can specify the IT
security requirements.
- When planning a move, details must be drawn up in advance of who will
be moving with what cargo to which location and at what time. This is of
course essential in order that work can be resumed as smoothly as possible
after the office move has been completed.
- The requirements which must be adhered to during transportation must be
determined in accordance with the level of protection the data requires. For
example, lockable transport containers should be used for more sensitive
data (see S 2.44 Secure packaging of data media) or alternatively the data
media should be encrypted prior to transportation.
- Data backups should be made before any IT systems are moved. In
addition to the parameters specified in S 6.35 Stipulating data backup
procedures, care should be taken here to ensure that under no
circumstances are the backups transported together with the IT systems
backed up. This will ensure that it is not possible for all storage media to be
damaged or go missing at the same time.
- An instruction sheet which provides details of all the IT security measures
to be taken should be prepared for all the employees concerned.
During a relocation, the actual removal is not the only critical phase: the
periods immediately before and after the move are equally critical. Experience
suggests that many items go missing in the phase immediately following the
move before standard security procedures such as access control can be put in
place. Certain organisational minimum requirements must therefore be
satisfied during the removal as well:
- Transport documents should be completed for all materials to be
transported. These should make clear
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000