IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Personnel Remarks
____________________________________________________________________ .........................................
S 3.3 Arrangements for substitution
Initiation responsibility: Head of Organisational Section; IT Security
Management
Implementation responsibility: Superiors
Substitution arrangements are designed to ensure continuity of operation in
case of absence or loss of personnel, both foreseeable (vacation,
business/official trip) and unforeseeable (illness, accident, notice of
termination of employment). Therefore, before such a situation arises,
provisions will have to be laid down on who will substitute for whom in what
fields of activity and with which authorities. This is of particular importance
as regards information processing which usually requires special knowledge
precluding that persons unfamiliar with the subject matter could be given
training in good time to act as substitutes.
For substitution, the following general conditions must be met:
- For assumption of tasks by substitutes, sufficient documentation must be
provided on the current status of the relevant procedures and on the
respective project.
- As a rule, designation of a substitute will not suffice; consideration must be
given to the training required by substitutes so that they will be qualified to
assume the specific tasks. If it comes to light that there are persons who, on
account of their specialist knowledge, cannot be replaced at short notice,
their unavailability constitutes a serious threat to normal operations. In
such cases, training of a substitute is of crucial importance.
- It must be laid down what range of tasks will have to be assumed by which
substitute(s).
- Designated substitutes may be granted the necessary entry and access
rights only when they actually have to act as deputies.
- If, in exceptional cases, it is not possible to designate or train a competent
substitute, early thought should be given to which external staff might be
called in to act as substitutes.
Additional controls:
- What provisions are made by the various organisational units as regards
substitution?
- Are substitutes available who are sufficiently competent?
- Has the unforeseen need arisen recently to provide substitutes?
- Within the organisational unit, is there a single source of knowledge, i.e.
one person who, by himself/herself, has all the expertise required for IT
uses?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000