IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- What training measures have to be undertaken before the product is used.
The approval notice must be brought to the attention of all those involved, in
particular copies must be available to the Approval Authority, the IT Division,
the Specialist Department and where necessary the IT user.
In addition to this, an organisational arrangement must be made that the
approval and any possible tests required will be repeated if basic features,
particularly in the area of security functions, have altered as a result of a
change of version or patches. Changes of the kind mentioned must be notified
to the person responsible for the approval of the product.
Furthermore, it can be specified which standard software products, depending
on the place of use and the intended use, will enjoy general approval. It is a
prerequisite that they have at least been tested for computer viruses, that the
licence questions have been resolved and that they are registered. Examples of
this would be:
- Demo versions for test purposes which are made available on special
computers,
- Public domain software which is installed on special servers,
- Games programs on special computers which are installed in staff rooms.
Additional controls:
- Where are the approval notices administered and deposited?
- Are installation instructions available?
- Is there a guarantee that all software is subjected to the approval
procedure?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000