IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
carefully. During the review all relevant information captured should be
documented and evaluated.
The results should be documented in an IT security report. This should
contain a technical description of the corrective actions proposed. The IT
security report, which may contain confidential information and therefore
need to be protected, should be presented to the IT Security Officer (assuming
that he did not perform the review himself) and be notified to the manager of
the division or department reviewed as well as to the IT Security Management
Team. Where serious problems exist, Management should be involved so that
any far-reaching decisions can be made promptly. For this purpose, a
management report on IT security should be prepared, as described in S 2.200
Preparation of management reports on IT security.
On the basis of the results of the review, decisions must be made as to where
to proceed from here; in particular all the corrective actions which are
necessary must be determined and specified in the form of an implementation
plan. Responsibilities for implementation of the corrective actions, which are
carried out in a similar fashion to the procedure described in S 2.196
Implementation of the IT security concept in accordance with an
implementation plan, must be assigned and the persons concerned provided
with the necessary resources.
In summary, it may be said that a given level of IT security can only be
maintained if
- maintenance of IT security in ongoing operations is facilitated by
appropriate organisational rules;
- responsibility for maintenance of IT security has been clearly assigned;
- measures are implemented in their entirety as described;
- measures are checked regularly to see if they are functioning as intended;
- measures are properly applied and adhered to and are accepted;
- measures are adapted if any new vulnerabilities come to light;
- measures are adjusted in line with changes in personnel, organisation,
hardware or software.
- changes in tasks or the importance of tasks to the organisation are taken
into account;
- changes to buildings, e.g. after moving premises, are taken into account;
- modifications are implemented in response to changes in threats and/or
vulnerabilities.
All these changes have a significant effect on the security risks. New security
risks should be identified at the earliest possible opportunity in order to permit
a timely response. Should it transpire that the actual risk differs from the
actual risk accepted in the IT security concept, resources should be made
available to change this situation.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
IT security report
Corrective actions
New security risks