IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- The access to the test environment must be controlled.
- When taken over into production, it must be ensured that the product is
configured in the same way as in the test environment. A suitable integrity
protection system (digital signatures, checksums) should thus be used in
the test environment.
- The costs for setting up the test environment must be acceptable.
After all planned tests have been concluded, it should be decided whether the
test environment is to be dismantled. It may be necessary for more tests to be
carried out, i.e. it might be viable to retain the test environment. Before the
test environment is dismantled, the test data should be deleted if no longer
required (e.g. for installation at a later date). Printer products should be
disposed of correctly, programs should be deinstalled. The test licences of the
products which were not selected should be returned.
Contents of the test documentation
The test plan should state how detailed the test documentation should be. The
aspects of comprehensibility, reproducibility and completeness should be
taken into consideration.
The test documentation must contain test plans, targets, processes and results.
It must also describe the correspondence between the tests and the specified
requirements. All test activities and the test evaluation (including reasons for
decisions) should be set down in writing. These include:
- product name and description
- test begin, end, and time
- persons-in-charge
- configuration of the test environment
- description of the test cases
- criteria for decisions, test results and argumentation
- unfulfilled requirements of the Requirement Catalogue
The test group should be able to have access to clear documentation and
records of the test activities and results (e.g. recording tool, forms etc.).
In the event that an automatic tool is used for testing, the test documentation
must contain sufficient information about this tool and its usage so that the
decision can be understood.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000