IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.10 Survey of the software held
Initiation responsibility: Agency/company management; Head of IT
Section; IT Security Management; superiors
Implementation responsibility: IT Security Management
In order to be able to detect any infringements of the ban on the use of nonapproved
software, regular checks must be made of the software inventory. In
case of a large number of IT systems, random checks may be made. The
findings of such checks must be documented in order to provide for detection
of any recurrences.
If non-approved software is found during such checks, arrangements should
be made for its removal. In order to be able to carry out these checks, the
reviewing entity must be vested with adequate powers by the company/agency
management. In addition, the reviewing entity must be informed of which
software is approved for which IT system (software inventory).
Additional controls:
- At what intervals are such checks recommended?
- Have there been cases in which non-approved software was used?
- How are infringements handled?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000