IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Finally, all members of staff should be made aware of the fact that
commitment, co-operation and responsible behaviour are expected of them
not only with regard to the fulfilment of tasks in general, but also with
regard to the fulfilment of the "IT security" task.
6. Drawing up additional IT system security policy documents
Separate IT system security policy documents should be prepared for IT
systems or IT services which are located in a security-critical area, whose
configuration is complex or which are relatively complex to use. Examples
here include system security policy documents for firewalls, anti-virus
protection measures, the use of e-mail or the use of Internet (see appendix
on Additional Aids (in German)). The IT system security guidelines should
contain:
- a description of the functionality of the system, the external
interfaces and the requirements relating to the operational
environment;
- a description of the threats against which the system is to be
protected;
- a description of the actions which persons or technical processes
may perform on data or programmes;
- a description of the protection requirements for the system objects;
- a description of the residual risks which the operator of the system
can accept;
- all the safeguards which are to be implemented in the system to
counter the threats;
- all the known vulnerabilities of the system.
Additional controls:
- Has the Information Security Policy been distributed to all staff affected?
- Are new members of staff referred to the Information Security Policy?
- Is the Information Security Policy updated at regular intervals?
- For which IT systems are there separate IT system security policy
documents?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000