IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
involved in all relevant procedures and decisions. The roles should be
integrated into the organisational structure in such a way that all those
involved can communicate with each other. The roles of IT Security Officer
and of being a member of the IT Security Management Team should be
entrusted to staff who possess the relevant specialist skills. If necessary, to
support these roles tasks can be delegated to the specific IT Security Officers
appointed for a given division or department, IT project or IT system.
The IT Security Officer
As the responsibility for IT security is delegated in the same way as the
responsibility for task accomplishment, the danger presented by unclear
delegation is that IT security is transformed into "someone else's problem".
The result is that the responsibility for IT security is shifted around until no
one takes responsibility for it any longer. To avoid this happening,
responsibility for IT security should be given directly to a specific role, that of
the IT Security Officer. This person is responsible for looking after all matters
of IT security within the organisation. The tasks of the IT Security Officer are:
- to be involved in the entire IT security process,
- to draw up IT system security policy documents,
- to co-ordinate drawing up of the Information Security Policy,
- to co-ordinate drawing up of the contingency planning concept and other
policy documents,
- to prepare the plan for implementation of IT security measures and initiate
and review the implementation,
- to report to the IT Security Management Team and Management,
- to ensure a smooth flow of information between the
divisional/departmental, project and system IT Security Officers,
- and to identify and examine any security-relevant incidents which occur.
In order to carry out these tasks, it is desirable that the IT Security Officer has
knowledge and experience in the areas of IT security and IT. As this task
requires a variety of skills, the person appointed to this position should
possess the following qualifications and attributes:
- He should identify with the objectives of IT security and appreciate the
necessity of IT security.
- He should be able to liaise and work as a member of a team. (Few other
projects require such a high degree of skill in working with other people:
Management must always be involved in central issues of the IT security
process, decisions must be sought and the IT users must be involved in the
IT security process, possibly with the help of the divisional/departmental
IT Security Officer).
- He must possess experience in project management, ideally in the area of
systems analysis (these are the main aspects which are also important in the
"IT Security" project and particularly in risk analysis).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Requirements profile