IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- specific areas can be found rapidly,
- it can be updated with minimum effort and
- it is adequately documented so that if standby staff ever need to use it they
are able to perform security-specific tasks using it.
To this end it is recommended that a security concept is structured by
responsibility or by subject-matter. Thus, a security concept based on IT
baseline protection should mirror the structure of the organisation or network
under examination.
A security concept can contain information which should not be passed on
freely, for example information about vulnerabilities which have not yet been
eliminated. This information must be kept confidential. This is achieved by
only making it available on a need-to-know basis. This will be facilitated if the
security concept is structured accordingly.
Additional controls:
- Does an IT security concept exist?
- When was it last updated?
- Where is the concept kept?
- Who is allowed access to it?
- Are people given access at least to those sections of the security concept
which directly concern them?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Confidentiality