IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
R E.03 Server room Bonn building S6, N6, N7 Modera
te
R 2.01 -
R 2.40
Offices Bonn building C4, some with fax
machines
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000
Modera
te
Interpreting the results of the protection requirement assessment
High High
Modera
te
Modera
te
The results obtained from the protection requirements assessment serve as the starting point from
which to proceed towards drawing up the IT security concept. The assumptions regarding protection
requirements categories which are used to deduce the level of protection afforded by the standard
security safeguards recommended in this manual are as follows:
Protective effect of standard security safeguards aimed at achieving IT baseline protection
Protection requirement category "Basic to
moderate"
Standard security safeguards aimed at IT baseline
protection are generally adequate and reasonable.
Protection requirement category "High" Standard security safeguards aimed at IT baseline
protection afford a basic level of protection but may
not be sufficient on their own. Additional safeguards
can be ascertained by performing a supplementary
security analysis.
Protection requirement category "Very
high"
Standard security safeguards aimed at IT baseline
protection afford a basic level of protection but
generally are not sufficient on their own. The necessary
additional security safeguards must be ascertained on a
case-by-case basis on the basis of a supplementary
security analysis.
If the protection requirement for an IT system is defined as "moderate", then it is sufficient to
implement the standard safeguards aimed at IT baseline protection across the board. For IT systems,
network connections and rooms where IT assets are used which have a "high", and especially if they
have a "very high", protection requirement, a supplementary security analysis should be planned in.
Again, the high protection requirement of these components should be borne in mind during the target
versus actual comparison when working through safeguards identified in the manual as being
"optional". Thus, for example, safeguard S 1.10 Use of Safety Doors may not be necessary in a server
room which has a moderate protection requirement, yet where a high level of confidentiality is
required it could be absolutely essential.