IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components
_________________________________________________________________________________________
2.4.2 Performing the Target Versus Actual Comparison
Once all the necessary preliminary work has been completed, the actual survey can begin on the
previously agreed dates. This entails working through the safeguards contained in the module for
which the person being interviewed is responsible in sequence.
The answers regarding implementation status for the individual safeguards may be classified into the
following categories:
„Unnecessary“ - Implementation of the recommended safeguards is not necessary in the form
suggested as other measures (e.g. safeguards which are not contained in the IT
Baseline Protection Manual but achieve the same effect) already provide
sufficient protection against the relevant threats, or else the measures
recommended are not relevant (e.g. because certain services have not been
implemented).
"Yes" - All the recommendations in the safeguard have been implemented effectively
and in their entirety.
"Partially" - Some of the recommendations have been implemented, while others have not
yet been implemented or only partially implemented.
"No" - Most of the recommendations contained in the safeguard have not yet been
implemented.
Reading out the text of the recommendations contained in a given safeguard during the interview is
not recommended as the manual was not designed for this purpose. Hence, the interviewer needs to be
familiar with the contents of the module. If necessary, handy checklists containing keywords should be
prepared in advance of the interviews. In order to be able to clarify any disagreements in case of
doubt, it is nevertheless useful to have the full text of the safeguards at hand. Direct entry of the
answers into a PC during the interview is likewise not recommended as it would be distracting to those
involved and cause unwanted interruption to communication.
If the interview begins with a few introductory words and the purpose of the basic security check is
briefly introduced, this can help to create a relaxed, open and productive atmosphere. It is
recommended continuing by naming and briefly explaining the safeguard. Rather than conducting a
monologue, it is better to give the interviewee(s) the opportunity to go into those parts of the safeguard
which have already been implemented and then discuss any items still at issue.
The questions asked should always be directed at the level of standard security safeguards, and only
after the basic security check has been completed should any more far-reaching aspects of highly
sensitive applications be considered. If there is a requirement to verify the statements made in the
interviews, this could be achieved, for example, by examining samples of the relevant procedures and
concepts, in the case of the area of infrastructure by visiting the objects under investigation on-site
with the contact person, and/or by checking client and/or server settings in selected IT systems.
To conclude each safeguard, the interviewee should be informed of the assessment result (i.e.
safeguard implementation status = Unnecessary/Yes/ Partially/No) and this decision should be
explained.
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000