IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
obligations and responsibilities of the external maintenance personnel must
also be carefully specified.
The execution of external maintenance work must be logged; which IT
systems or components have been sent away for repair, when and to whom,
who was responsible, when the repair should be finished and when the
machine was brought back. For reference, registration of the IT systems or
components is necessary. On the one hand, this makes it clear to which
organisation these systems belong, and on the other hand it allows
straightforward classification within the organisation.
It must be ensured that damages or theft are prevented during transit of the IT
components which are to be repaired. If sensitive data is still to be found on
the IT systems, they must be transported with the appropriate protection, e.g.
via locked containers or couriers. Moreover, proof of dispatch (accompanying
documents, dispatch note) and arrival (confirmation of receipt) must be
carried out and logged.
In the case of IT systems protected with passwords and depending on the
scope of repair work and type of password security, all or some of the
passwords must be made known, or settings must be established such as
"REPAIR", so that the maintenance technicians can access the machines.
Once the IT systems or components have been handed back, their
completeness must be checked. All passwords must be changed. PC datamedia
must be checked for computer viruses with an up-to-date anti-virus
program. All files contained in the repaired machine must be checked as
regards their integrity.
Remote maintenance
Regulations for remote maintenance are contained in S 5.33 Secure remote
maintenance via modem.
Additional controls:
- Are the staff encouraged to ensure supervision?
- Are records kept to account for the maintenance work carried out?
- Has a timetable been laid down for maintenance work?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000