IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
IT Co-ordination
Committee
IT user
representatives
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Agency /
Company
Management
IT Security
Officer
Project / System
IT Security
Officer
Information
Security
Policy and
procedures
Entire organisation
Specific systems/projects
Project /
System
Information
Security Policy
and procedures
Figure 2: Organisational structure of IT security management in a mediumsized
organisation
IT Officer
Agency /
Company
Management
IT Security
Officer
Information
Security Policy
and
procedures
Figure 3: Organisational structure of IT security management in a small
organisation
At this point it should be made clear that these central roles do not necessarily
have to be performed by more than one person. Staffing arrangements should
reflect the size of the organisation concerned, the existing resources and the
aspired-to level of IT security. On the other hand, it should be emphasised that
IT security comes at a price. Those in positions of responsibility must have
sufficient resources at their disposal so that they can devote sufficient effort to
the "IT security" task. This will have more than paid for itself if there are
fewer damaging incidents due to lack of security provision.
IT security management tasks, responsibility and authority
The IT Security Officer and the IT Security Management Team must have
clearly defined tasks, responsibilities and authorities, which must be laid down
by Management. In order to be able to perform their tasks, they should both be
Necessary resources
Integration into the
organisational structure