IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
A structured implementation plan is essential if the IT security measures
identified are to be properly implemented. The IT Security Management Team
is responsible for drawing up the implementation plan. Depending on their
type and scope, the individual safeguards are implemented either by the user
of the IT system concerned or a responsible IT adviser. Implementation of the
safeguards must be supported by the IT Security Management Team. In
particular, every employee must know in advance to whom he should turn in
the event of any problems occurring.
The following should be documented in an implementation plan:
- name of the person responsible for implementation of a safeguard,
- priority of the safeguard to be implemented,
- statement of the time by which the safeguard must have been implemented,
- person to whom implementation of the safeguard must be reported, once
complete,
- provision of resources (manpower, resource requirements, space
requirements, costs).
It is a good idea to pave the way for or accompany implementation of the
safeguards by providing appropriate training for the IT users and raising their
security awareness (see safeguards S 2.197 Drawing up a training concept for
IT security and M 2.198 Making staff aware of IT security issues).
Additional controls:
- Do the recommendations regarding security measures contained in the IT
security concept define clearly who is responsible for initiation and
implementation?
- Is there an implementation plan?
- Are reviews performed and documented?
- Is Management informed of the results?
- Are the rules for implementation of IT security measures documented?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Implementation phase