IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Working together with IT users requires a high degree of skill as these users
must first be convinced of the necessity of IT security, which some of them
may perceive as a burden. Equally difficult is questioning IT users about
sensitive incidents and weak spots. In order to guarantee success here, the IT
users must be convinced that honest answers will not cause them problems.
The IT Security Management Team
The IT Security Management Team supports the IT Security Officer with the
performance of his tasks by co-ordinating measures which impact the entire
organisation, compiling information and performing supervisory tasks. The
precise shape of the team will depend on the size of the organisation
concerned, the aspired-to level of IT security and the available resources. In
extreme cases the IT Security Management Team may consist of only one
person, the IT Security Officer, who in this case is responsible for all the tasks
in the IT security process.
Tasks of the IT Security Management Team include:
- specifying IT security objectives and strategies and developing the
Information Security Policy,
- reviewing implementation of the Information Security Policy,
- initiating, directing and monitoring the IT security process,
- helping to draw up the IT security concept,
- examining whether the IT security measures planned in the Information
Security Policy function as intended and are appropriate and effective,
- approving the IT security measure implementation plan and making
available the necessary resources,
- preparing the programme of IT security and IT security awareness
promotion training courses, and
- advising the IT Co-ordination Committee and Management on IT security
issues.
In order to be able to carry out its tasks effectively, the IT Security
Management Team members should have knowledge of IT security, technical
knowledge of IT systems and experience in organisation and administration.
In addition, the IT Security Management Team should reflect the different
operational areas within the organisation. As a minimum, the IT Security
Management Team should include an IT Officer, the IT Security Officer and
an IT user representative. If a similar body already exists in the organisation,
its tasks could be extended accordingly. However, to underline the importance
of IT security it is advisable to set up an IT Security Management Team and to
place at its disposal the resources it needs.
Only a few organisations, either very large ones or ones with high IT security
requirements, will be able to make full-time staff available to the IT Security
Management Team. Normally these tasks will have to be performed in
addition to the employees' primary duties. An exception to this, however,
might be the first occasion that the IT security process is set up. If possible,
the members of the IT Security Management Team should be released from
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Co-operation
Composition of the team
Team members to have
sufficient time available