IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- Adhering to internal regulations and legal stipulations (e.g. sufficient
data protection when processing person-related data)
Brief examples:
- The product must comply with the principles of proper EDPcontrolled
auditing systems.
- As person-related data are processed, it must be possible to meet the
requirements stipulated in the Federal Data Privacy Act.
- Requirements regarding user-friendliness, characterised by how easy
the system is to operate, understand and learn, i.e. particularly by the
quality of the user interface and documentation, and the help functions.
Brief examples:
- An on-line help function must be available.
- The user interface must be designed in such a way that unskilled
persons can become familiar with the basic functions within two
hours.
- The documentation should be available in the local language.
- Requirements concerning serviceability for the user are mainly based on
the handling of errors.
Brief examples:
- The amount of administration involved must not be too high.
- The provider must offer a hotline for questions.
- The product must be easy to install and configure.
- The product must be easy to deinstall.
- The maximum costs resulting from the purchase of this product are
predetermined. Not only the immediate purchase costs should be taken into
consideration, but also costs arising at a later date, e.g. for updating
hardware, personnel costs or training.
Brief examples:
- The product may cost a maximum of DM 15,000.
- The training costs must not exceed DM 2,000.
- The requirements concerning documentation must highlight which
documents are required and in which quality (completeness,
comprehensibility).
Brief examples:
- The user documentation must be easy to understand and suitable for
reading without instruction. All functions of the product should be
described.
- The system manager documentation must include troubleshooting
information.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000