ISMS.1 Security Management

An organisation's Top Management MUST take overall responsibility for information security in the organisation. This MUST be clear to everyone involved. The Top Management MUST initiate, control, and monitor the security process. The Top Management MUST set a good example regarding information security.

The Top Management MUST define the responsibilities for information security. The responsible employees MUST be equipped with the necessary skills and resources.

The Top Management MUST be regularly informed about the organisation's information security status. In particular, the Top Management MUST be informed about possible risks and consequences due to a lack of security safeguards.

An organisation's Top Management MUST initiate and establish the security process. For this purpose, the Top Management MUST define and document appropriate security objectives and an information security strategy. Conceptual specifications MUST be developed and organisational framework conditions established to enable the proper and secure handling of information within all the organisation's business processes or specialised tasks.

The Top Management MUST support and take responsibility for its organisation's security strategy and security objectives. The Top Management MUST regularly review these security objectives and the security strategy to ensure that they are still relevant and appropriate and can be implemented effectively.

An organisation's Top Management MUST adopt an overarching information security policy. This MUST describe the value of information security, the organisation's security objectives, the most important elements of the security strategy, and the organisational structure for information security. The scope of the security policy MUST be clearly defined. The policy for information security MUST explain the security objectives and how they relate to the business objectives and tasks of the organisation.

The Top Management MUST communicate the information security policy to all staff and other members of the organisation. The information security policy SHOULD be updated regularly.

An organisation's Top Management MUST appoint a Chief Information Security Officer (CISO). The CISO MUST promote information security in the organisation and help steer and coordinate the security process.

The Top Management MUST provide the CISO with adequate resources. The Top Management MUST allow the CISO to report directly to it when required.

The CISO MUST be involved at an early stage in all larger projects and in the introduction of new applications and IT systems.

An organisation's Top Management MUST appoint an external Chief Information Security Officer (CISO) if the role of CISO cannot be filled by an internal employee. The contract with the external CISO MUST include all the tasks of the CISO and their related rights and obligations. The contract MUST include an appropriate confidentiality agreement. The contract MUST ensure that the corresponding relationship is terminated in an orderly fashion, including with regard to the handover of tasks back to the organisation in question.

An organisation MUST have a suitable higher-level organisational structure for information security. For this purpose, roles MUST be defined that will take on specific tasks to achieve the security objectives at hand. Qualified persons MUST also be appointed with sufficient resources to take on these roles. The tasks, roles, responsibilities, and competencies in security management MUST be defined and assigned in a transparent manner. Effective deputising rules MUST be in place for all the important functions within an information security organisation.

Communication channels MUST be planned, described, set up, and publicised. For all tasks and roles, it MUST be specified who will inform whom, who must be informed of which actions, and what information is to be provided.

It MUST be checked at regular intervals whether the organisational structure for information security is still adequate or needs to be adapted to new framework conditions.

As part of the security process, detailed and adequate security safeguards MUST be defined for all aspects of information processing. All security safeguards SHOULD be documented systematically in security concepts. These security safeguards SHOULD be updated at regular intervals.

All of an organisation's employees MUST be integrated into its security process. For this purpose, they MUST be informed about the background and the hazards relevant to them. They MUST know and implement security safeguards that affect their workplace.

All employees MUST be enabled to make active contributions to security. Employees SHOULD therefore be involved at an early stage in planning security safeguards or devising organisational regulations.

When introducing security policies and security tools, employees MUST be adequately informed about how these should be used.

Employees MUST be made aware of the consequences of breaching security rules.

Information security MUST be integrated into all business processes and specialised tasks. In so doing, it MUST be ensured that all necessary security aspects are not only taken into account in new processes and projects, but also in ongoing activities. The Chief Information Security Officer MUST be adequately involved in making security-relevant decisions.

Moreover, information security SHOULD be coordinated with other areas of an organisation that deal with security and risk management.

For the specified scope (the information domain), an adequate security concept SHOULD be drawn up as the central document in the security process. It SHOULD also be decided whether the security concept can also consist of several sub-concepts that are drawn up successively to establish the required level of security in selected areas first.

In the security concept, specific security safeguards appropriate for the information domain under consideration MUST be derived from the security objectives of the organisation in question, the protection needs identified, and the risk evaluation conducted. The security process and the security concept MUST take the individually applicable regulations and provisions into account.

The safeguards provided in the security concept MUST be implemented promptly in practice. Their implementation MUST be planned and monitored.

An organisation SHOULD review its security process, security concepts, information security policy, and organisational structure for information security in terms of their appropriateness and effectiveness and update them at regular intervals. Completeness and update checks of the security concept SHOULD also be performed regularly in this regard.

Security audits SHOULD be performed regularly. In this regard, there SHOULD be rules that specify which areas and security safeguards need to be checked when and by whom. The level of security SHOULD be reviewed regularly (at least once a year) and whenever there is a reason to do so.

These reviews SHOULD be performed by qualified and independent persons. The results of the reviews SHOULD be documented in a transparent manner. Based on this, shortcomings SHOULD be eliminated and corrective measures taken.

An organisation's Top Management SHOULD be regularly informed about the status of information security—in particular, about the current threat landscape and the effectiveness and efficiency of its security process. In addition, management reports SHOULD be written that contain the most important information relevant to the security process, especially with regard to problems, successes, and potential improvements. The management reports SHOULD contain clearly prioritised proposals for action. The proposed actions SHOULD be accompanied by realistic estimates of the expected implementation effort. The management reports SHOULD be archived in an audit-compliant manner.

Management decisions relating to required actions, the handling of residual risks, and changes to security-relevant processes SHOULD be documented. These management decisions SHOULD be archived in an audit-compliant manner.

The security process SHOULD be documented. Important decisions and the work results of the individual phases, such as the security concept, policies, or findings resulting from examinations of security incidents, SHOULD be documented adequately.

A procedure SHOULD be defined for the creation and archiving of documentation within the framework of the security process. Rules SHOULD be in place to ensure that documentation is kept up to date and confidential. The respective current versions of existing documents SHOULD be available on short notice. Furthermore, all previous versions SHOULD be archived centrally.

An organisation's security strategy SHOULD take economic aspects into account. If security safeguards are defined, the resources required for them SHOULD be quantified. The resources planned for information security SHOULD be provided on time. Additional internal employees or external experts SHOULD be called in for workload peaks or special tasks.

In addition to general security policies, there SHOULD be target-group-oriented security policies that cover the relevant security topics as needed.

It SHOULD be examined whether insurance can be taken out against residual risks. An organisation's existing insurance policies SHOULD be checked regularly to ensure they are still appropriate for the current situation.