IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- seeking decisions from the responsible line manager (up to Management
level).
In every case of a discrepancy between actual practice and what was planned a
corrective action should be suggested. The person who will be responsible for
implementing the control measure and the date by which it is to be
implemented should also be established.
The IT security audit also includes a check as to whether log files and filter
settings have been evaluated and monitored where necessary.
The purpose of an update check is to establish
- whether the IT security measures are still adequate to achieve the IT
security objectives,
- whether the IT security measures are still sufficient to reduce the risk,
- whether the IT security objectives are still relevant.
It could transpire as a result of this update check, for example, that so many
changes have taken place that the IT security measures no longer provide
protection against current risks, the IT security process does not run in an
optimal fashion or mistakes are being made in IT security management. In all
three cases the reasons for the security loopholes should be established.
Depending on the cause, possible corrective actions could include:
- changes in IT security management,
- adaptation of the IT security process
- identification of new threats,
- use of new technology (IT systems and applications),
- use of new IT security technologies,
- changes in the IT security measures
- action in response to new laws and statutory instruments or amendments to
these, and
- action in response to changes in the latest version of the IT Baseline
Protection Manual.
A corrective action should be suggested for every instance of a security
weakness. Moreover, the person responsible for directing and monitoring the
corrective measures should be established or, if appropriate, the additional risk
could be considered to be acceptable.
The update check also includes examining whether changes of every kind
have - where necessary - met with an adequate response
The points listed below regarding performance of the review apply to both
types of review, both the IT security audit and the update check.
The scope and depth of the review should be determined with reference to the
purpose of the review. The IT security concept and the existing documentation
of the IT security process serve as the basis for the review. The review, which
can be performed either in-house or by external consultants, must be planned
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Procedure
Planning