IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.14 Replacement procurement plan
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator; staff responsible for the
individual IT applications
In case of the failure of parts of the IT system, in addition to repair,
replacement procurement will initially be the most purposive measure to
achieve restoration of availability.
In order to expedite the replacement process, it is useful to establish a
replacement procurement plan. For each major IT component, this plan must
provide information on:
- designation of the IT component (name, device number, date of
procurement);
- manufacturer;
- supplier;
- period of delivery; and
- time required for re-installation.
If several manufacturers or suppliers can be named for a given IT component,
they are to be listed as alternatives. It may also be possible to include
references to other products. In the replacement procurement process, such
information is needed for economical resource management.
In addition to restoring the availability of the IT system, advances in
information technology must also be taken account of in the context of
replacement measures. If used parts of the IT system no longer come up to the
best available technology, a replacement procurement activity must not be
aimed exclusively at restoring the status ante quo. For this purpose, the
replacement procurement plan must be regularly revised. Attention must be
paid to the interrelations with resources control (cf. S 2.2 Resources control).
Additional controls:
- At what intervals are revisions made of the replacement procurement plan?
- In case of changes made to the IT system, will the replacement
procurement plan be revised?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000