+CON.9 Information Exchange
---+CON.9.G1. Delayed Availability of Information
---+CON.9.G2. Unregulated Forwarding of information
---+CON.9.G3. Sharing False or Internal Information
---+CON.9.G4. Unauthorised Copying and Modification of Information
---+CON.9.G5. Inadequate Application of Encryption Procedures
---+CON.9.A1 Definition of Authorised Recipients [Central Administration, Users] (B)
---+CON.9.A2 Regulating the Exchange of Information [Central Administration, User] (B)
---+CON.9.A3 Instruction of Personnel on Exchanges of Information [Process Owner] (B)
---+CON.9.A4 Agreements on Exchanging Information with External Parties [Central Administration] (S)
---+CON.9.A5 Removal of Residual Information Prior to Sharing [User] (S)
---+CON.9.A6 Compatibility Checks on Sender and Recipient Systems (S)
---+CON.9.A7 Backup Copies of Transferred Data [User] (S)
---+CON.9.A8 Encryption and Digital Signatures (S)
---+CON.9.A9 Confidentiality Agreements [Central Administration, User] (H)
|
CON.9 Information Exchange
IntroductionInformation is transmitted between senders and recipients through communication channels as various as personal conversations, telephone calls, letters, removable media, and data networks. Rules on the exchange of information ensure that confidential information is only passed on to authorised persons. Such rules are particularly necessary when information is transmitted via external data networks. ObjectiveThe objective of this module is to secure the exchange of information between various communication partners. This module can help establish a concept for secure information exchange. Scoping and ModellingModule CON.9 Information Exchange must be applied once to the entire information domain under consideration if information is to be exchanged with communication partners outside of the information domain. The protection of network connections is dealt with in other modules of the IT-Grundschutz Compendium; see layer NET Networks and Communication. Requirements for removable media (see module SYS.4.5 Removable Media) and further processing in IT systems outside of an information domain are not considered in this module. Useful ResourcesThe International Organization for Standardization (ISO) describes requirements for the exchange of information in its standard ISO/IEC 27001:2013, section 13.2.
1. Oversigt
| Titel |
Standard |
|
CON.9.A1 Definition of Authorised Recipients [Central Administration, Users] (B)
|
The Central Administration MUST ensure that the disclosure of information does not violate any related legal frameworks. The Central Administration MUST define which recipients are allowed to receive and share which information. The channels through which the respective information may be exchanged MUST be defined. Before exchanging information, each employee MUST ensure that the recipient has the necessary authorisations to receive and process the information.
|
|
CON.9.A2 Regulating the Exchange of Information [Central Administration, User] (B)
|
Before information is exchanged, the information owner MUST determine its level of sensitivity. The information owner MUST determine how to protect the information during transmission. If sensitive information is being transmitted, the information owner MUST inform the recipient about its level of sensitivity. If the information is sensitive, the information owner MUST also inform the recipient that they may only use the information for the purpose for which it was transmitted.
|
|
CON.9.A3 Instruction of Personnel on Exchanges of Information [Process Owner] (B)
|
The Process Owner MUST inform all the relevant employees about the framework conditions for each information exchange. The Process Owner MUST ensure that the employees know what information they can pass on, as well as when, where, and how.
|
|
CON.9.A4 Agreements on Exchanging Information with External Parties [Central Administration] (S)
|
If information is regularly exchanged with other organisations, the organisation in question SHOULD formally agree on a corresponding framework. This information exchange agreement SHOULD include information on the protection of all confidential information.
|
|
CON.9.A5 Removal of Residual Information Prior to Sharing [User] (S)
|
In addition to general training, an organisation SHOULD inform its users about the dangers of residual and additional information in documents and files. The users SHOULD be taught how to avoid residual and additional information in documents and files. The organisation SHOULD instruct each user on how to exclude unwanted residual information from exchanges of information. Users SHOULD check each file and document for undesired information before transferring files. Users SHOULD remove unwanted residual information from documents and files.
|
|
CON.9.A6 Compatibility Checks on Sender and Recipient Systems (S)
|
Before exchanging information, the compatibility of the sender and receiver IT systems and products SHOULD be checked.
|
|
CON.9.A7 Backup Copies of Transferred Data [User] (S)
|
Users SHOULD make a backup copy of transmitted information in case the information cannot be restored from other sources.
|
|
CON.9.A8 Encryption and Digital Signatures (S)
|
An organisation SHOULD check whether information can be cryptographically secured during an exchange. If information is to be cryptographically secured, sufficiently secure procedures SHOULD be used for this purpose.
|
|
CON.9.A9 Confidentiality Agreements [Central Administration, User] (H)
|
Before disclosing confidential information to external parties, the user SHOULD inform the Central Administration. The Central Administration SHOULD conclude a confidentiality agreement with the recipients in question. The confidentiality agreement SHOULD regulate how the information may be kept on the receiving side. The confidentiality agreement SHOULD specify who on the receiving side may have access to which transmitted information.
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|