IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
When writing management reports it should be borne in mind that the people
who will be reading them are generally not technical experts. Accordingly, the
text should be concise and easy to understand. The author should concentrate
on the major points, i.e. in particular on existing vulnerabilities but also on
successes achieved, and not attempt to convey a "complete" picture.
Management reports - especially those prepared in response to particular
events -should always end with a list of recommended actions, clearly
prioritised, together with a realistic assessment of the expected cost of
implementation of each of these actions. This will ensure that the decisions
needed can be obtained from Management without undue delay.
Wherever possible, the "IT Security" management report should not simply be
provided to Management in writing but should also be presented in person by
a member of the IT Security Management Team. Personal delivery of the
report in this way allows special emphasis to be placed on important points,
especially on any existing or anticipated security defects. At the same time,
the person responsible for IT security making the presentation is directly
available for further questions and also to provide fuller explanations, and
experience shows that this in turn speeds up the decision process. At the same
time, such personal contact offers the opportunity to establish a "small official
channel", whose existence could prove extremely useful in an emergency.
Instead of or in addition to personal presentation of the management report,
another option which should be considered is to make one senior manager
who has the appropriate technical background and interest available as a point
of contact. Such a course of action can also prepare the way for Management
decisions and eliminate problems in advance.
As part of the ongoing IT security process, all the "IT security" management
reports, if appropriate annotated with the decisions made, should be archived
in a systematic fashion together with the other IT security-relevant documents
and be made readily accessible to all those in positions of responsibility for
security on demand (see S 2.201 Documentation of the IT security process).
As the IT security management reports will generally contain sensitive
information about existing security loopholes and residual risks, they must be
kept confidential. Reliable means must be adopted to ensure that they are not
disclosed to unauthorised person.
Additional controls:
- Are the "IT Security" management reports archived together with other
documents relating to the IT security process?
- Are there any "suitable" senior managers in the organisation with whom
the management report can be agreed in advance so as to prepare the way
for its submission?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Basic principle:
keep it brief and easy to
understand
White Paper
Suitable presentation
Co-operation with
Management
Documentation
Confidentiality