IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.8 Alert plan
Initiation responsibility: Agency/company management
Implementation responsibility: Head of IT Section; Head of Organisational
Section; IT Security Management; staff
responsible for the individual IT applications
An alert plan contains a description of the reporting channel through which the
units/individuals concerned are to be notified when an emergency has
occurred. The alert can be given, for instance, over the telephone, by fax, by
paging systems, or by courier. It must be laid down who notifies whom, who
is alternatively to be notified and what action should be taken if this
person/unit cannot be contacted. For this purpose, address and telephone lists
might have to be kept.
The alert plan must be available to all persons responsible for emergency
procedures and, in addition, a redundant copy must be held centrally (e.g.
entrance control staff, guards). The individuals listed in the alert plan must be
familiar with the part concerning them. All staff members must know the
contact persons to whom the occurrence of an incident, which might lead to an
emergency, can be reported.
Different alert plans may have been established for different damaging
incidents (fire, water, breakdown of data transmission). In that case, care must
be taken to cover all types of incidents.
In addition to the compilation of an alert plan, the establishment of an on-duty
service should be considered.
Additional controls:
- Is the alert reporting channel being tested sporadically?
- When was the alert plan last reviewed?
- Are all individuals listed in the alert plan still employed in the
agency/company?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000