IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
most of their other duties during this phase. The decision as to whether staff
should be released and to what extent this is appropriate will depend on the
distribution of tasks between the IT Security Management Team and the IT
Security Officer. The final decision here lies with Management. Whatever
arrangements are adopted, the IT Security Management Team should meet
regularly to ensure continuous oversight of the IT security process.
Area IT security officer, IT project and IT system security officers
In large organisations it can be necessary to employ separate IT Security
Officers in each of the various business units (referred to below as the "Area
IT Security Officer"). The Area IT Security Officer is responsible for all
security aspects of the IT systems and applications in his area (e.g.
department, branch etc.). Depending on the size of the business unit, the task
of Area IT Security Officer can be assumed by somebody who is already
entrusted with similar tasks, e.g. the person might already perform the role of
Divisional IT Officer (if such a position exists). Care should be taken during
selection of the Area IT Security Officer to ensure that he is familiar with the
tasks, conditions and work processes in the relevant business unit.
The various IT systems and applications within an organisation often have
different IT security requirements, which may be compiled in a separate IT
system security policy document and require different IT security measures.
The analogous situation applies to the IT project Security Officer, with the
distinction that his role is IT project-specific instead of IT system-specific.
The tasks of the IT Project, IT System and Area Security Officers include:
- implementing the procedures defined by the IT Security Officer,
- implementing the IT security measures in accordance with the IT system
security policy,
- collecting IT system-specific information and forwarding it to the IT
Security Officer,
- acting as contact person for the local IT users,
- being involved in the selection of IT security measures used to implement
the IT system security policy,
- passing information about IT users’ training or IT security awareness
promotion requirements to the IT Security Officer,
- monitoring and evaluating log files at regular intervals, and
- reporting any security-relevant incidents to the IT Security Officer.
Persons in these roles should possess the following qualifications:
- in-depth IT knowledge, as this makes it easier to talk to IT users on-site
and facilitates the search for IT security safeguards for the special IT
systems;
- knowledge of project management - this is helpful when it comes to
interviewing IT users and drawing up plans for the implementation and
monitoring of IT security measures.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000