+IT-Grundschutz-Compendium
---+G 0.1 Fire
---+G 0.2 Unfavourable Climatic Conditions
---+G 0.3 Water
---+G 0.4 Pollution, Dust, Corrosion
---+G 0.5 Natural Disasters
---+G 0.6 Catastrophes in the Vicinity
---+G 0.7 Major Events in the Vicinity
---+G 0.8 Failure or Disruption of the Power Supply
---+G 0.9 Failure or Disruption of Communication Networks
---+G 0.10 Failure or Disruption of Supply Networks
---+G 0.11 Failure or Disruption of Service Providers
---+G 0.12 Electromagnetic Interference
---+G 0.13 Interception of Compromising Interference Signals
---+G 0.14 Interception of Information / Espionage
---+G 0.15 Eavesdropping
---+G 0.16 Theft of Devices, Storage Media and Documents
---+G 0.17 Loss of Devices, Storage Media and Documents
---+G 0.18 Poor Planning or Lack of Adaptation
---+G 0.19 Disclosure of Sensitive Information
---+G 0.20 Information or Products from an Unreliable Source
---+G 0.21 Manipulation with Hardware or Software
---+G 0.22 Manipulation of Information
---+G 0.23 Unauthorised Access to IT Systems
---+G 0.24 Destruction of Devices or Storage Media
---+G 0.25 Failure of Devices or Systems
---+G 0.26 Malfunction of Devices or Systems
---+G 0.27 Lack of Resources
---+G 0.28 Software Vulnerabilities or Errors
---+G 0.29 Violations of Laws or Regulations
---+G 0.30 Unauthorised Use or Administration of Devices and Systems
---+G 0.31 Incorrect Use or Administration of Devices and Systems
---+G 0.32 Misuse of Authorisation
---+G 0.33 Shortage of Personnel
---+G 0.34 Assault
---+G 0.35 Coercion, Blackmail or Corruption
---+G 0.36 Identity theft
---+G 0.37 Repudiation of Actions
---+G 0.38 Misuse of Personal Information
---+G 0.39 Malware
---+G 0.40 Denial of Service
---+G 0.41 Sabotage
---+G 0.42 Social Engineering
---+G 0.43 Attack with Specially Crafted Messages
---+G 0.44 Unauthorised Entry to Premises
---+G 0.45 Data Loss
---+G 0.46 Loss of Integrity of Sensitive Information
---+G 0.47 Harmful Side Effects of IT-Supported Attacks
---+Security Management
------+ISMS.1 Security Management
---------+ISMS.1.G1. Lack of Personal Responsibility in the Security Process
---------+ISMS.1.G2. Lack of Support from Top Management
---------+ISMS.1.G3. Inadequate Strategic and Conceptual Specifications
---------+ISMS.1.G4. Inadequate or Misdirected Investments
---------+ISMS.1.G5. Inadequate Enforcement of Security Safeguards
---------+ISMS.1.G6. Failure to Update the Security Process
---------+ISMS.1.G7. Violation of Statutory Regulations and Contractual Agreements
---------+ISMS.1.G8. Business Process Disruptions due to Security Incidents
---------+ISMS.1.G9. Uneconomical Use of Resources due to Inadequate Security Management
---------+ISMS.1.A1 Acceptance of Overall Responsibility for Information Security by Top Management [Top Management] (B)
---------+ISMS.1.A2 Defining Security Objectives and Strategy [Top Management] (B)
---------+ISMS.1.A3 Drawing Up an Information Security Policy [Top Management] (B)
---------+ISMS.1.A4 Appointment of a Chief Information Security Officer [Top Management] (B)
---------+ISMS.1.A5 Contract Design When Appointing an External Chief Information Security Officer [Top Management] (B)
---------+ISMS.1.A6 Establishment of a Suitable Organisational Structure for Information Security [Top Management] (B)
---------+ISMS.1.A7 Definition of Security Safeguards (B)
---------+ISMS.1.A8 Integration of Employees into the Security Process [Supervisor] (B)
---------+ISMS.1.A9 Integrating Information Security into Organisation-Wide Procedures and Processes [Top Management] (B)
---------+ISMS.1.A10 Drawing Up a Security Concept (S)
---------+ISMS.1.A11 Continuity of Information Security (S)
---------+ISMS.1.A12 Management Reports on Information Security [Top Management] (S)
---------+ISMS.1.A13 Documentation of the Security Process (S)
---------+ISMS.1.A15 Cost-Effective Use of Resources for Information Security (S)
---------+ISMS.1.A16 Creating Target-Group-Orientated Security Policies (H)
---------+ISMS.1.A17 Taking Out Insurance (H)
---+Organisation and Personnel
------+ORP.1 Organisation
---------+ORP.1.G1. Insufficient Rules
---------+ORP.1.G2. Non-Compliance with Regulations
---------+ORP.1.G3. Inadequate or Incompatible Resources
---------+ORP.1.G4. Threats from Outside the Organisation
---------+ORP.1.A1 Specification of Responsibilities and Provisions [Top Management]
---------+ORP.1.A2 Assigning Responsibilities [Top Management] (B)
---------+ORP.1.A3 Supervising or Escorting External Individuals [Employee] (B)
---------+ORP.1.A4 Separation of Roles Between Incompatible Tasks (B)
---------+ORP.1.A15 Contact Persons for Information Security Issues (B)
---------+ORP.1.A8 Managing Resources and Devices [IT Operation Department] (S)
---------+ORP.1.A13 Security During Relocation [IT Operation Department, Building Services] (S)
---------+ORP.1.A16 Policy for Secure IT Use [User] (S)
------+ORP.2 Personnel
---------+ORP.2.G1. Shortage of Personnel
---------+ORP.2.G2. Insufficient Knowledge of Rules and Procedures
---------+ORP.2.G3. Carelessness in Handling Information
---------+ORP.2.G4. Insufficient Employee Qualifications
---------+ORP.2.A1 Well-Regulated Orientation of New Employees [Supervisor] (B)
---------+ORP.2.A2 Regulated Procedure for Employees Leaving the Organisation [Supervisor, IT Operation Department] (B)
---------+ORP.2.A3 Defining Deputising Rules [Supervisor] (B)
---------+ORP.2.A4 Defining Procedures for Using Third-Party Personnel (B)
---------+ORP.2.A5 Confidentiality Agreements for Third-Party Personnel (B)
---------+ORP.2.A14 Tasks and Responsibilities of Employees [Supervisor] (B)
---------+ORP.2.A15 Qualifications of Personnel [Supervisor] (B)
---------+ORP.2.A7 Verifying the Trustworthiness of Employees (S)
---------+ORP.2.A13 Security Vetting (H)
------+ORP.3 Awareness and Training in Information Security
---------+ORP.3.G1. Insufficient Knowledge of Rules and Procedures
---------+ORP.3.G2. Insufficient Awareness of Information Security
---------+ORP.3.G3. Ineffective Awareness and Training Activities
---------+ORP.3.G4. Insufficient Employee Training Regarding Security Functions
---------+ORP.3.G5. Undetected Security Incidents
---------+ORP.3.G6. Non-Compliance with Security Safeguards
---------+ORP.3.G7. Carelessness in Handling Information
---------+ORP.3.G8. Lack of Acceptance of Information Security Policies
---------+ORP.3.G9. Social Engineering
---------+ORP.3.A1 Top Management Awareness of Information Security Issues [Supervisor, Top Management] (B)
---------+ORP.3.A3 Training Employees in the Secure Handling of IT [Supervisor, Human Resources Department, IT Operation Department] (B)
---------+ORP.3.A4 Designing and Planning an Information Security Awareness and Training Program (S)
---------+ORP.3.A6 Implementation of Information Security Awareness and Training Measures (S)
---------+ORP.3.A7 Training in the IT-Grundschutz Methodology (S)
---------+ORP.3.A8 Measurement and Evaluation of Training Success [Human Resources Department] (S)
---------+ORP.3.A9 Special Training for Exposed Persons and Organisations (H)
------+ORP.4 Identity and Access Management
---------+ORP.4.G1. Insufficient Processes in Identity and Access Management
---------+ORP.4.G2. No Central Means of Disabling User Access Authorisations
---------+ORP.4.G3. Incorrect Administration of Site, System, and Data Access Rights
---------+ORP.4.A1 Regulation for Creating and Deleting Users and User Groups [IT Operation Department] (B)
---------+ORP.4.A2 Creating, Changing, and Revoking Authorisations [IT Operation Department] (B)
---------+ORP.4.A3 Documentation of User IDs and Rights Profiles [IT Operation Department] (B)
---------+ORP.4.A4 Distribution of Tasks and Separation of Roles [IT Operation Department] (B)
---------+ORP.4.A5 Assignment of Site Access Rights [IT Operation Department] (B)
---------+ORP.4.A6 Assignment of System Access Rights [IT Operation Department] (B)
---------+ORP.4.A7 Assignment of Data Access Rights [IT Operation Department] (B)
---------+ORP.4.A8 Provisions Governing the Use of Passwords [User, IT Operation Department] (B)
---------+ORP.4.A9 Identification and Authentication [IT Operation Department] (B)
---------+ORP.4.A22 Regulating Password Quality [IT Operation Department] (B)
---------+ORP.4.A23 Regulating Password-Processing Applications and IT Systems [IT Operation Department] (B)
---------+ORP.4.A10 Protection of User IDs with Wide-Ranging Authorisations [IT Operation Department] (S)
---------+ORP.4.A11 Resetting Passwords [IT Operation Department] (S)
---------+ORP.4.A12 Developing an Authentication Concept for IT Systems and Applications [IT Operation Department] (S)
---------+ORP.4.A13 Selection of Suitable Authentication Mechanisms [IT Operation Department] (S)
---------+ORP.4.A14 Checking the Effectiveness of User Separation in IT Systems or Applications [IT Operation Department] (S)
---------+ORP.4.A15 Approach and Design of Identity and Access Management Processes [IT Operation Department] (S)
---------+ORP.4.A16 Policies for Data and System Access Control [IT Operation Department] (S)
---------+ORP.4.A17 Suitable Selection of Identity and Access Management Systems [IT Operation Department] (S)
---------+ORP.4.A18 Using a Central Authentication Service [IT Operation Department] (S)
---------+ORP.4.A19 Instruction of All Employees in the Handling of Authentication Methods and Mechanisms [User, Head of IT] (S)
---------+ORP.4.A20 Contingency Planning for the Identity and Access Management System [IT Operation Department] (H)
---------+ORP.4.A21 Multi-Factor Authentication [IT Operation Department] (H)
---------+ORP.4.A24 Dual Control for Administrative Activities [IT Operation Department] (H)
------+ORP.5 Compliance Management
---------+ORP.5.G1. Violations of Legal Provisions
---------+ORP.5.G2. Improper Forwarding of Information
---------+ORP.5.G3. Inadequate Checking of the Identity of Communication Partners
---------+ORP.5.G4. Accidental Sharing of Internal Information
---------+ORP.5.A1 Identification of Framework Conditions [Central Administration, Top Management] (B)
---------+ORP.5.A2 Compliance with Framework Conditions [Supervisor, Central Administration, Top Management] (B)
---------+ORP.5.A4 Design and Organisation of Compliance Management [Top Management] (S)
---------+ORP.5.A5 Granting Exceptions [Supervisor, Chief Information Security Officer (CISO)] (S)
---------+ORP.5.A8 Regular Reviews of Compliance Management (S)
---+Concepts and Procedures
------+CON.1 Crypto Concept
---------+CON.1.G1. Inadequate Key Management for Encryption
---------+CON.1.G2. Violation of Legal Framework Conditions Regarding the Use of Cryptographic Methods
---------+CON.1.G3. Loss of Data Confidentiality or Integrity Due to Misbehaviour
---------+CON.1.G4. Software Vulnerabilities or Errors in Crypto Modules
---------+CON.1.G5. Failure of a Crypto Module
---------+CON.1.G6. Insecure Cryptographic Algorithms or Products
---------+CON.1.G7. Errors in Encrypted Data or Cryptographic Keys
---------+CON.1.G8. Unauthorised Use of a Crypto Module
---------+CON.1.G9. Compromised Cryptographic Keys
---------+CON.1.G10. Forged Certificates
---------+CON.1.A1 Selecting Appropriate Cryptographic Methods [Process Owner]
---------+CON.1.A2 Backups When Using Cryptographic Methods [IT Operation Department] (B)
---------+CON.1.A3 Encryption of Communication Links (S)
---------+CON.1.A4 Appropriate Key Management (S)
---------+CON.1.A5 Secure Deletion and Destruction of Cryptographic Keys [IT Operation Department] (S)
---------+CON.1.A6 Identifying the Need for Cryptographic Methods and Products [IT Operation Department, Process Owner] (S)
---------+CON.1.A7 Drawing Up a Security Policy for the Use of Cryptographic Methods and Products (H)
---------+CON.1.A8 Determining the Factors That Influence Cryptographic Methods and Products (H)
---------+CON.1.A9 Selecting an Appropriate Cryptographic Product [IT Operation Department, Process Owner] (H)
---------+CON.1.A10 Developing a Crypto Concept (H)
---------+CON.1.A11 Secure Configuration of Crypto Modules [IT Operation Department] (H)
---------+CON.1.A12 Secure Separation of Roles When Using Crypto Modules [IT Operation Department] (H)
---------+CON.1.A13 Operating System Security Requirements When Using Crypto Modules (H)
---------+CON.1.A14 Training of Users and Administrators [Supervisor, Process Owner, IT Operation Department] (H)
---------+CON.1.A15 Reacting to the Practical Weakening of a Crypto Method (H)
---------+CON.1.A16 Physical Protection of Crypto Modules [IT Operation Department] (H)
---------+CON.1.A17 Emission Security [IT Operation Department] (H)
---------+CON.1.A18 Cryptographic Replacement Modules [IT Operation Department] (H)
------+CON.2 Data Protection
---------+CON.2.G1. Non-Compliance with Data Protection Laws or Use of an Incomplete Risk Model
---------+CON.2.G2. Definition of Insufficient Protection Needs
---------+CON.2.A1 Implementing the German Standard Data Protection Model (B)
------+CON.3 Backup Concept
---------+CON.3.G1. Lack of Backups
---------+CON.3.G2. Lack of Recovery Tests
---------+CON.3.G3. Unsuitable Storage of Backup Media
---------+CON.3.G4. Inadequate Documentation
---------+CON.3.G5. Non-Compliance with Statutory Regulations
---------+CON.3.G6. Using Insecure Providers for Online Backups
---------+CON.3.G7. Insufficient Storage Capacity
---------+CON.3.G8. Inadequate Backup Concept
---------+CON.3.G9. Insufficient Data Backup Speed
---------+CON.3.G10. Ransomware
---------+CON.3.A1 Determining the Factors That Influence Backups [Process Owner, IT Operation Department] (B)
---------+CON.3.A2 Establishment of Backup Procedures [Process Owner, IT Operation Department] (B)
---------+CON.3.A4 Creating Backup Plans [IT Operation Department] (B)
---------+CON.3.A5 Regular Backups [IT Operation Department] (B)
---------+CON.3.A12 Secure Storage of Backup Media [IT Operation Department] (B)
---------+CON.3.A14 Protection of Backups [IT Operation Department] (B)
---------+CON.3.A15 Regular Backup Testing [IT Operation Department] (B)
---------+CON.3.A6 Developing a Backup Concept [Process Owner, IT Operation Department] (S)
---------+CON.3.A7 Procuring a Suitable Backup System [IT Operation Department] (S)
---------+CON.3.A9 Prerequisites of Online Backups [IT Operation Department] (S)
---------+CON.3.A13 Using Cryptographic Methods for Backups [IT Operation Department] (H)
------+CON.6 Deleting and Destroying Data and Devices
---------+CON.6.G1. Non-Existent or Insufficiently Documented Regulations for Deletion and Destruction
---------+CON.6.G2. Loss of Confidentiality due to Residual Information on Storage Media
---------+CON.6.G3. Inappropriate Involvement of External Service Providers in the Deletion and Destruction Process
---------+CON.6.G4. Inappropriate Handling of Defective Storage Media or IT Devices
---------+CON.6.A1 Regulations for Deleting or Destroying Information [Central Administration, Process Owner, Data Protection Officer, IT Operation Department] (B)
---------+CON.6.A2 Proper Deletion and Destruction of Sensitive Resources and Information (B)
---------+CON.6.A11 Deletion and Destruction of Storage Media by External Service Providers (B)
---------+CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B)
---------+CON.6.A4 Selecting Suitable Methods for Deleting or Destroying Storage Media (S)
---------+CON.6.A8 Creating a Policy for Deleting and Destroying Information [Employee, IT Operation Department, Data Protection Officer] (S)
---------+CON.6.A13 Destruction of Defective Digital Storage Media (S)
---------+CON.6.A14 Destruction of Storage Media at Increased Security Levels (H)
------+CON.7 Information Security on Trips Abroad
---------+CON.7.G1. Eavesdropping and Spying on Information/Industrial Espionage
---------+CON.7.G2. Disclosure and Misuse of Sensitive Information (Electronic and Physical)
---------+CON.7.G3. Use of False Identities
---------+CON.7.G4. Lack of Security Awareness and Carelessness in Handling Information
---------+CON.7.G5. Violation of Local Laws or Regulations
---------+CON.7.G6. Coercion, Extortion, Hijacking, and Corruption
---------+CON.7.G7. Information from Unreliable Sources
---------+CON.7.G8. Theft or Loss of Devices, Storage Media, and Documents
---------+CON.7.A1 Security Policy for Information Security on Trips Abroad
---------+CON.7.A2 Raising Employee Awareness of Information Security When Travelling Abroad (B)
---------+CON.7.A3 Identification of Country-Specific Regulations, Travel Conditions and Environmental Conditions [Human Resource Department]
---------+CON.7.A4 Use of Privacy Screens [User] (B)
---------+CON.7.A5 Use of Screen/Code Locking [User] (B)
---------+CON.7.A6 Prompt Reporting of a Loss [User]
---------+CON.7.A7 Secure Remote Access to an Organisation's Network [IT Operation Department, User] (B)
---------+CON.7.A8 Secure Use of Public WLANs [User] (B)
---------+CON.7.A9 Secure Handling of Mobile Storage Media [User] (B)
---------+CON.7.A10 Encryption of Portable IT Systems and Storage Media [User, IT Operation Department] (B)
---------+CON.7.A12 Secure Destruction of Sensitive Materials and Documents [User] (B)
---------+CON.7.A11 Use of Anti-Theft Devices [User] (S)
---------+CON.7.A13 Transporting Necessary Data and Storage Media [User] (S)
---------+CON.7.A14 Cryptographically Secured E-Mail Communication [User, IT Operation Department] (S)
---------+CON.7.A15 Emission Security for Portable IT Systems (H)
---------+CON.7.A16 Protecting Integrity Using Checksums or Digital Signatures [User] (H)
---------+CON.7.A17 Use of Dedicated Travel Hardware [IT Operation Department] (H)
---------+CON.7.A18 Restricted Authorisations on Trips Abroad [IT Operation Department] (H)
------+CON.8 Software Development
---------+CON.8.G1. Selection of an Unsuitable Process Model
---------+CON.8.G2. Selection of an Unsuitable Development Environment
---------+CON.8.G3. Inadequate Quality Assurance in the Development Process
---------+CON.8.G4. Inadequate Documentation
---------+CON.8.G5. Inadequately Secured Use of Development Environments
---------+CON.8.G6. Software Design Errors
---------+CON.8.G7. Inadequate Testing and Approval Procedures
---------+CON.8.G8. Software Testing with Production Data
---------+CON.8.A2 Selection of a Process Model (B)
---------+CON.8.A3 Selection of a Development Environment (B)
---------+CON.8.A5 Secure System Design (B)
---------+CON.8.A6 Use of External Libraries from Trusted Sources (B)
---------+CON.8.A7 Conducting Software Tests During Development [Tester, Developer] (B)
---------+CON.8.A8 Provision of Patches, Updates, and Changes [Developer] (B)
---------+CON.8.A10 Source Code Version Management [Developer] (B)
---------+CON.8.A20 Checking External Components (B)
---------+CON.8.A1 Definition of Roles and Responsibilities [Central Administration] (S)
---------+CON.8.A11 Drawing Up a Policy for Software Development (S)
---------+CON.8.A12 Detailed Documentation (S)
---------+CON.8.A14 Training Development Teams on Information Security (S)
---------+CON.8.A16 Appropriate Control of Software Development (S)
---------+CON.8.A21 Threat Modelling (S)
---------+CON.8.A22 Secure Software Design (S)
---------+CON.8.A17 Selection of Trusted Development Tools (H)
---------+CON.8.A18 Periodic Security Audits of the Development Environment (H)
---------+CON.8.A19 Regular Integrity Audits of the Development Environment [IT Operation Department] (H)
------+CON.9 Information Exchange
---------+CON.9.G1. Delayed Availability of Information
---------+CON.9.G2. Unregulated Forwarding of information
---------+CON.9.G3. Sharing False or Internal Information
---------+CON.9.G4. Unauthorised Copying and Modification of Information
---------+CON.9.G5. Inadequate Application of Encryption Procedures
---------+CON.9.A1 Definition of Authorised Recipients [Central Administration, Users] (B)
---------+CON.9.A2 Regulating the Exchange of Information [Central Administration, User] (B)
---------+CON.9.A3 Instruction of Personnel on Exchanges of Information [Process Owner] (B)
---------+CON.9.A4 Agreements on Exchanging Information with External Parties [Central Administration] (S)
---------+CON.9.A5 Removal of Residual Information Prior to Sharing [User] (S)
---------+CON.9.A6 Compatibility Checks on Sender and Recipient Systems (S)
---------+CON.9.A7 Backup Copies of Transferred Data [User] (S)
---------+CON.9.A8 Encryption and Digital Signatures (S)
---------+CON.9.A9 Confidentiality Agreements [Central Administration, User] (H)
------+CON.10 Development of Web Applications
---------+CON.10.G1. Bypassing Authorisations in Web Applications
---------+CON.10.G2. Insufficient Input Validation and Output Encoding
---------+CON.10.G3. Insufficient Error Handling by Web Applications
---------+CON.10.G4. Insufficient Logging of Security-Relevant Events
---------+CON.10.G5. Disclosure of Security-Relevant Information Through Web Applications
---------+CON.10.G6. Misuse of a Web Application Due to Automated Use
---------+CON.10.G7. Inadequate Session Management in Web Applications
---------+CON.10.A1 Authentication for Web Applications (B)
---------+CON.10.A2 Access Control for Web Applications (B)
---------+CON.10.A3 Secure Session Management (B)
---------+CON.10.A4 Controlled Integration of Content in Web Applications (B)
---------+CON.10.A5 Upload Functions (B)
---------+CON.10.A6 Protection Against Unauthorised Automated Use of Web Applications (B)
---------+CON.10.A7 Protection of Confidential Data (B)
---------+CON.10.A8 Comprehensive Input Validation and Output Encoding (B)
---------+CON.10.A9 Protection Against SQL Injections (B)
---------+CON.10.A10 Restrictive Disclosure of Security-Related Information (B)
---------+CON.10.A11 Software Architecture of a Web Application (S)
---------+CON.10.A12 Verification of Essential Changes (S)
---------+CON.10.A13 Error Handling (S)
---------+CON.10.A14 Secure HTTP Configuration of Web Applications (S)
---------+CON.10.A15 Prevention of Cross-Site Request Forgery (S)
---------+CON.10.A16 Multi-Factor Authentication (S)
---------+CON.10.A17 Preventing Resources from Being Blocked (H)
---------+CON.10.A18 Cryptographic Protection of Confidential Data (H)
---+Operations
------+OPS.1.1.2 Proper IT Administration
---------+OPS.1.1.2.G1. Failures Caused by Unspecified Responsibilities
---------+OPS.1.1.2.G2. Shortage of Personnel with Core Competencies
---------+OPS.1.1.2.G3. Misuse of Administrative Authorisations
---------+OPS.1.1.2.G4. Inadequate Consideration of Administrative Tasks
---------+OPS.1.1.2.G5. Operational Disruptions
---------+OPS.1.1.2.G6. Lack of Options for Investigating Incidents
---------+OPS.1.1.2.A2 Deputising Rules and Contingency Planning (B)
---------+OPS.1.1.2.A3 Controlled Hiring of IT Administrators (B)
---------+OPS.1.1.2.A4 Termination of IT Administration Duties [Human Resources Department] (B)
---------+OPS.1.1.2.A5 Verifying Administrative Tasks (B)
---------+OPS.1.1.2.A6 Protecting Administrative Tasks (B)
---------+OPS.1.1.2.A7 Regulation of IT Administration Tasks (S)
---------+OPS.1.1.2.A8 Administration of Specialised Applications (S)
---------+OPS.1.1.2.A9 Sufficient Resources for the IT Operation Department (S)
---------+OPS.1.1.2.A10 Further Education and Information (S)
---------+OPS.1.1.2.A11 Documentation of IT Administration Tasks (S)
---------+OPS.1.1.2.A12 Provisions for Maintenance and Repairs (S)
---------+OPS.1.1.2.A20 Administration and Commissioning of Devices (S)
---------+OPS.1.1.2.A14 Security Vetting of Administrators [Human Resources Department] (H)
---------+OPS.1.1.2.A15 Division of Administrative Activities (H)
---------+OPS.1.1.2.A16 Access Restrictions for Administrative Access (H)
---------+OPS.1.1.2.A17 Dual Control in IT Administration (H)
---------+OPS.1.1.2.A18 Consistent Logging of Administrative Activities (H)
---------+OPS.1.1.2.A19 Consideration of High-Availability Requirements (H)
------+OPS.1.1.3 Patch and Change Management
---------+OPS.1.1.3.G1. Poorly Defined Responsibilities
---------+OPS.1.1.3.G2. Poor Communication in Change Management
---------+OPS.1.1.3.G3. Poor Consideration of Business Processes and Specialised Tasks
---------+OPS.1.1.3.G4. Insufficient resources for patch and change management
---------+OPS.1.1.3.G5. Problems in Automating the Distribution of Patches and Changes
---------+OPS.1.1.3.G6. Poor Recovery Options in Patch and Change Management
---------+OPS.1.1.3.G7. Misjudging the Relevance of Patches and Changes
---------+OPS.1.1.3.G8. Manipulation of Data and Tools in Change Management
---------+OPS.1.1.3.A1 Concept for Patch and Change Management [Process Owner] (B)
---------+OPS.1.1.3.A2 Definition of Responsibilities (B)
---------+OPS.1.1.3.A3 Configuration of Auto-Update Mechanisms (B)
---------+OPS.1.1.3.A15 Regular Updating of IT Systems and Software (B)
---------+OPS.1.1.3.A16 Regular Search for Information on Patches and Vulnerabilities (B)
---------+OPS.1.1.3.A5 Handling Change Requests [Process Owner] (S)
---------+OPS.1.1.3.A6 Coordination of Change Requests (S)
---------+OPS.1.1.3.A7 Integration of Change Management into Business Processes (S)
---------+OPS.1.1.3.A8 Secure Use of Tools for Patch and Change Management (S)
---------+OPS.1.1.3.A9 Testing and Acceptance Procedures for New Hardware (S)
---------+OPS.1.1.3.A10 Assuring the Integrity and Authenticity of Software Packages (S)
---------+OPS.1.1.3.A11 Continuous Documentation of Information Processing (S)
---------+OPS.1.1.3.A12 Use of Tools in Change Management (H)
---------+OPS.1.1.3.A13 Measuring the Success of Change Requests [Process Owner] (H)
---------+OPS.1.1.3.A14 Synchronisation Within Change Management (H)
------+OPS.1.1.4 Protection Against Malware
---------+OPS.1.1.4.G1. Software Vulnerabilities and Drive-By Downloads
---------+OPS.1.1.4.G2. Extortion through Ransomware
---------+OPS.1.1.4.G3. Targeted Attacks and Social Engineering
---------+OPS.1.1.4.G4. Botnets
---------+OPS.1.1.4.G5. Infection of Production Systems and IoT Devices
---------+OPS.1.1.4.A1 Creating a Malware Protection Concept (B)
---------+OPS.1.1.4.A2 Using System-Specific Protection Mechanisms (B)
---------+OPS.1.1.4.A3 Selection of a Virus Protection Program (B)
---------+OPS.1.1.4.A5 Operation and Configuration of Virus Protection Programs (B)
---------+OPS.1.1.4.A6 Regular Updating of Virus Protection Programs and Signatures (B)
---------+OPS.1.1.4.A7 User Awareness and Obligations [User] (B)
---------+OPS.1.1.4.A9 Reporting Malware Infections [User] (S)
---------+OPS.1.1.4.A10 Using Special Analysis Environments (H)
---------+OPS.1.1.4.A11 Using Several Scan Engines (H)
---------+OPS.1.1.4.A12 Using Storage Media Locks (H)
---------+OPS.1.1.4.A13 Handling Untrusted Files (H)
---------+OPS.1.1.4.A14 Selecting and Using Cyber Security Products to Thwart Targeted Attacks (H)
------+OPS.1.1.5 Logging
---------+OPS.1.1.5.G1. Insufficient Logging
---------+OPS.1.1.5.G2. Incorrect Selection of Relevant Log Data
---------+OPS.1.1.5.G3. Lack of Proper Time Synchronisation During Logging
---------+OPS.1.1.5.G4. Poor Planning of Logging
---------+OPS.1.1.5.G5. Loss of Confidentiality and Integrity in Log Data
---------+OPS.1.1.5.G6. Incorrectly Configured Logging
---------+OPS.1.1.5.G7. Failure of Log Data Sources
---------+OPS.1.1.5.G8. Insufficient Logging Infrastructure Capacity
---------+OPS.1.1.5.A1 Drawing Up a Security Policy for Logging [Process Owner] (B)
---------+OPS.1.1.5.A3 Configuring Logging at the System and Network Level (B)
---------+OPS.1.1.5.A4 Time Synchronisation of IT Systems (B)
---------+OPS.1.1.5.A5 Complying with Legal Framework Conditions (B)
---------+OPS.1.1.5.A6 Basic Structure of a Centralised Logging Infrastructure (S)
---------+OPS.1.1.5.A8 Archiving of Log Data (S)
---------+OPS.1.1.5.A9 Providing Log Data for Assessment (S)
---------+OPS.1.1.5.A10 Access Protection for Log Data (S)
---------+OPS.1.1.5.A11 Increasing the Scope of Logging (H)
---------+OPS.1.1.5.A12 Encryption of Log Data (H)
---------+OPS.1.1.5.A13 Highly Available Logging Infrastructure (H)
------+OPS.1.1.6 Software Tests and Approvals
---------+OPS.1.1.6.G1. Software Testing with Production Data
---------+OPS.1.1.6.G2. Insufficient Testing Procedures
---------+OPS.1.1.6.G3. Insufficient Approval Procedures
---------+OPS.1.1.6.G4. Inadequate Documentation of Tests and Test Results
---------+OPS.1.1.6.G5. Inadequate Documentation of Approval Criteria
---------+OPS.1.1.6.A1 Planning of Software Tests (B)
---------+OPS.1.1.6.A2 Performing Functional Software Tests [Tester] (B)
---------+OPS.1.1.6.A3 Assessing Test Results [Tester] (B)
---------+OPS.1.1.6.A4 Software Approval [Process Owner] (B)
---------+OPS.1.1.6.A5 Performing Software Tests for Non-Functional Requirements [Tester] (B)
---------+OPS.1.1.6.A11 Using Anonymised or Pseudonymised Test Data [Data Protection Officer, Tester] (B)
---------+OPS.1.1.6.A6 Orderly Instruction of Software Testers [Process Owner] (S)
---------+OPS.1.1.6.A7 Selecting Software Testers [Human Resources Department, Process Owner] (S)
---------+OPS.1.1.6.A10 Drawing Up an Acceptance Plan (S)
---------+OPS.1.1.6.A12 Performing Regression Tests [Tester] (S)
---------+OPS.1.1.6.A13 Separating the Test Environment from the Production Environment (S)
---------+OPS.1.1.6.A15 Verification of Installation and Related Documentation [Tester] (S)
---------+OPS.1.1.6.A14 Performing Penetration Tests [Tester] (H)
---------+OPS.1.1.6.A16 Security Vetting of Testers (H)
------+OPS.1.1.7 System Management
---------+OPS.1.1.7.G1. Unauthorised Access to the System Management Solution
---------+OPS.1.1.7.G2. Errors in Automation Functions for System Management
---------+OPS.1.1.7.G3. Unauthorised Interference in System Management Communication
---------+OPS.1.1.7.G4. Insufficient Time Synchronisation of System Management Components
---------+OPS.1.1.7.G5. Incompatibility Between the Systems to Be Managed and the System Management Solution
---------+OPS.1.1.7.G6. Loss of Connection Between Users and the System Management Solution
---------+OPS.1.1.7.G7. Loss of Connection Between the System Management Solution and Systems to be Managed
---------+OPS.1.1.7.G8. Insufficient Coordination Between System Management and Network Management
---------+OPS.1.1.7.A1 Specification of System Management Requirements (B)
---------+OPS.1.1.7.A2 System Management Planning (B)
---------+OPS.1.1.7.A3 Time Synchronisation for System Management (B)
---------+OPS.1.1.7.A4 Protection of System Management Communication (B)
---------+OPS.1.1.7.A5 Mutual Authentication Between the System Management Solution and Systems to be Managed (B)
---------+OPS.1.1.7.A6 Securing Access to the System Management Solution (B)
---------+OPS.1.1.7.A7 Definition of a Security Policy for System Management (S)
---------+OPS.1.1.7.A8 Drawing Up a System Management Concept (S)
---------+OPS.1.1.7.A9 Detailed and Implementation Planning for System Management (S)
---------+OPS.1.1.7.A10 Concept for Secure Operation of the System Management Solution (S)
---------+OPS.1.1.7.A11 Regular Gap Analysis Within the Framework of System Management (S)
---------+OPS.1.1.7.A12 Triggering Actions by the Central Components of the System Management Solution (S)
---------+OPS.1.1.7.A13 Commitment to the Use of Designated Interfaces for System Management (S)
---------+OPS.1.1.7.A14 Central Configuration Management for Systems to be Managed (S)
---------+OPS.1.1.7.A15 Status Monitoring, Logging, and Alerting of Relevant Events in the System Management Solution and the Systems to be Managed (S)
---------+OPS.1.1.7.A16 Integration of System Management into Contingency Planning (S)
---------+OPS.1.1.7.A17 Control of System Management Communication (S)
---------+OPS.1.1.7.A18 System State Verification (S)
---------+OPS.1.1.7.A19 Securing System Management Communications Between the System Management Solution and the Systems Being Managed (S)
---------+OPS.1.1.7.A20 Implementing System Management Solutions for High Availability (H)
---------+OPS.1.1.7.A21 Physical Separation of the Central System Management Network (H)
---------+OPS.1.1.7.A22 Integration of System Management into Automated Detection Systems (S)
---------+OPS.1.1.7.A23 Cross-Site Time Synchronisation for System Management (H)
---------+OPS.1.1.7.A24 Automated Checking of Security-Relevant Configurations by Suitable Detection Systems (H)
---------+OPS.1.1.7.A25 Logging and Regulation of System Management Meetings (H)
---------+OPS.1.1.7.A26 Decoupling of Access to the System Management Solution (H)
------+OPS.1.2.2 Archiving
---------+OPS.1.2.2.G1. Obsolescence of Archive Systems
---------+OPS.1.2.2.G2. Inadequate Indexing Keys for Archives
---------+OPS.1.2.2.G3. Unauthorised Archive Access due to Insufficient Logging
---------+OPS.1.2.2.G4. Inadequate Transfer of Paper-Based Data to an Electronic Archive
---------+OPS.1.2.2.G5. Insufficient Renewal of Cryptographic Procedures During Archiving
---------+OPS.1.2.2.G6. Insufficient Archiving Audits
---------+OPS.1.2.2.G7. Violation of Legal Framework Conditions Regarding the Use of Archive Systems
---------+OPS.1.2.2.A1 Determining Parameters for Electronic Archiving (B)
---------+OPS.1.2.2.A2 Drawing up an Archiving Concept (B)
---------+OPS.1.2.2.A3 Appropriate Installation of Archive Systems and Storage of Archive Media [IT Operation Department] (B)
---------+OPS.1.2.2.A4 Consistent Indexing of Data During Archiving [IT Operation Department, User] (B)
---------+OPS.1.2.2.A5 Regular Regeneration of Archived Data [IT Operation Department] (B)
---------+OPS.1.2.2.A6 Protection of the Integrity of the Index Database of Archive Systems [IT Operation Department] (B)
---------+OPS.1.2.2.A7 Regular Backups of System and Archive Data [IT Operation Department] (B)
---------+OPS.1.2.2.A8 Logging Archival Access [IT Operation Department] (B)
---------+OPS.1.2.2.A9 Selection of Suitable Data Formats for Archiving Documents [IT Operation Department] (B)
---------+OPS.1.2.2.A10 Drawing Up a Policy for Using Archive Systems [IT Operation Department] (S)
---------+OPS.1.2.2.A11 Instruction Regarding the Administration and Operation of the Archive System [IT Operation Department, User] (S)
---------+OPS.1.2.2.A12 Monitoring of Storage Resources for Archive Media [IT Operation Department] (S)
---------+OPS.1.2.2.A13 Regular Auditing of Archiving Processes (S)
---------+OPS.1.2.2.A14 Regular Observation of the Market for Archive Systems [IT Operation Department] (S)
---------+OPS.1.2.2.A15 Regular Processing of Cryptographically Secured Data During Archiving [IT Operation Department] (S)
---------+OPS.1.2.2.A16 Regular Renewal of Technical Archive System Components [IT Operation Department] (S)
---------+OPS.1.2.2.A17 Selecting a Suitable Archiving System [IT Operation Department] (S)
---------+OPS.1.2.2.A18 Using Appropriate Archive Media [IT Operation Department] (S)
---------+OPS.1.2.2.A19 Regular Function and Recovery Tests for Archiving [IT Operation Department] (S)
---------+OPS.1.2.2.A20 Appropriate Use of Cryptographic Methods for Archiving [IT Operation Department] (H)
---------+OPS.1.2.2.A21 Transfer of Paper-based Data to Electronic Archives (H)
------+OPS.1.2.4 Teleworking
---------+OPS.1.2.4.G1. Insufficient Rules for Teleworking Locations
---------+OPS.1.2.4.G2. Unauthorised Private Use of Teleworking Computers
---------+OPS.1.2.4.G3. Delays Caused by Temporarily Restricted Availability of Employees
---------+OPS.1.2.4.G4. Poor Integration of Employees into the Information Flow
---------+OPS.1.2.4.G5. Non-Compliance with Security Safeguards
---------+OPS.1.2.4.A1 Rules on Teleworking [Supervisor, Human Resources Department] (B)
---------+OPS.1.2.4.A2 Security-Related Requirements for Teleworking Computers (B)
---------+OPS.1.2.4.A5 Employee Awareness and Training (B)
---------+OPS.1.2.4.A6 Creating a Security Concept for Teleworking (S)
---------+OPS.1.2.4.A7 Regulations on Using Communication Capabilities for Teleworking [IT Operation Department, Employee] (S)
---------+OPS.1.2.4.A8 Flow of Information Between Employees and Organisations [Supervisor, Employee] (S)
---------+OPS.1.2.4.A9 Support and Maintenance Concept for Teleworking Locations [IT Operation Department, Employee] (S)
---------+OPS.1.2.4.A10 Analysis of Teleworking Location Requirements [IT Operation Department] (S)
------+OPS.1.2.5 Remote Maintenance
---------+OPS.1.2.5.G1. Inadequate Knowledge of Remote Maintenance Regulations
---------+OPS.1.2.5.G2. Inadequate Planning and Rules for Remote Maintenance
---------+OPS.1.2.5.G3. Inappropriate Use of Authentication During Remote Maintenance
---------+OPS.1.2.5.G4. Improper Remote Maintenance
---------+OPS.1.2.5.G5. Use of Insecure Protocols in Remote Maintenance
---------+OPS.1.2.5.G6. Insecure and Uncontrolled Use of Remote Maintenance Access by Third Parties
---------+OPS.1.2.5.G7. Use of Online Services for Remote Maintenance
---------+OPS.1.2.5.G8. Unknown Remote Maintenance Components
---------+OPS.1.2.5.A1 Planning the Use of Remote Maintenance (B)
---------+OPS.1.2.5.A2 Establishing a Secure Connection for Remote Maintenance of Clients [User] (B)
---------+OPS.1.2.5.A3 Securing Interfaces for Remote Maintenance (B)
---------+OPS.1.2.5.A5 Use of Online Services (S)
---------+OPS.1.2.5.A6 Drawing Up a Policy for Remote Maintenance (S)
---------+OPS.1.2.5.A7 Documentation During Remote Maintenance (S)
---------+OPS.1.2.5.A8 Secure Protocols for Remote Maintenance (S)
---------+OPS.1.2.5.A9 Selection and Acquisition of Suitable Remote Maintenance Tools (S)
---------+OPS.1.2.5.A10 Management of Remote Maintenance Tools (S)
---------+OPS.1.2.5.A17 Authentication Mechanisms for Remote Maintenance (S)
---------+OPS.1.2.5.A19 Remote Maintenance by Third Parties (S)
---------+OPS.1.2.5.A20 Remote Maintenance Operations (S)
---------+OPS.1.2.5.A21 Creation of a Business Continuity Plan in Case of Remote Maintenance Failure (S)
---------+OPS.1.2.5.A24 Securing Integrated Remote Maintenance Systems (S)
---------+OPS.1.2.5.A25 Decoupling of Communication During Remote Maintenance (S)
---------+OPS.1.2.5.A14 Dedicated Clients for Remote Maintenance (H)
---------+OPS.1.2.5.A22 Redundant Communication Links (H)
------+OPS.1.2.6 NTP Time Synchronisation
---------+OPS.1.2.6.G1. Insufficient Planning of the Use of NTP
---------+OPS.1.2.6.G2. Missing or Incorrect Time Information
---------+OPS.1.2.6.G3. Conflicting Time Information
---------+OPS.1.2.6.G4. Manipulation of NTP Communication
---------+OPS.1.2.6.A1 Planning the Use of NTPs (B)
---------+OPS.1.2.6.A2 Secure Use of External Time Sources (B)
---------+OPS.1.2.6.A3 Secure Configuration of NTP Servers (B)
---------+OPS.1.2.6.A4 Failure to Account for Unsolicited Time Information (B)
---------+OPS.1.2.6.A5 Use of Client-Server Mode for NTP (S)
---------+OPS.1.2.6.A6 Monitoring of IT Systems Using NTP (S)
---------+OPS.1.2.6.A7 Secure Configuration of NTP Clients (S)
---------+OPS.1.2.6.A8 Use of Secure Time Synchronisation Protocols (S)
---------+OPS.1.2.6.A9 Sufficient Availability of Accurate Time Sources (H)
---------+OPS.1.2.6.A10 Internal NTP Servers Only (H)
---------+OPS.1.2.6.A11 Redundant NTP Servers (H)
---------+OPS.1.2.6.A12 NTP Servers with Authenticated Information (H)
------+OPS.2.1 Outsourcing for Customers
---------+OPS.2.1.G1. Insufficient Rules Regarding Information Security
---------+OPS.2.1.G2. Incorrect Administration of Site, System and Data Access Rights
---------+OPS.2.1.G3. Inadequate testing and approval procedures
---------+OPS.2.1.G4. Inadequate contractual arrangements with outsourcing service providers
---------+OPS.2.1.G5. Insufficient terms for the end of an outsourcing project
---------+OPS.2.1.G6. Dependency on an Outsourcing Service Provider
---------+OPS.2.1.G7. Disruption of the Office Atmosphere due to an Outsourcing Project
---------+OPS.2.1.G8. Inadequate Information Security in the Early Stages of Outsourcing
---------+OPS.2.1.G9. Failure of an Outsourcing Service Provider’s Systems
---------+OPS.2.1.G10. Vulnerabilities in the Connection to an Outsourcing Service Provider
---------+OPS.2.1.G11. Lack of Multi-Client Capability with the Outsourcing Service Provider
---------+OPS.2.1.A1 Specification of Security Requirements for Outsourcing Projects (B)
---------+OPS.2.1.A2 Timely Involvement of Employee Representatives [Central Administration] (S)
---------+OPS.2.1.A3 Selection of a Suitable Outsourcing Service Provider (S)
---------+OPS.2.1.A4 Contractual Arrangements with the Outsourcing Service Provider (S)
---------+OPS.2.1.A5 Establishing an Outsourcing Strategy (S)
---------+OPS.2.1.A6 Drawing up a Security Concept for the Outsourcing Project [Process Owner] (S)
---------+OPS.2.1.A7 Definition of Possible Communication Partners [Central Administration] (S)
---------+OPS.2.1.A8 Provisions for Deploying the Personnel of the Outsourcing Service Provider [Human Resources Department] (S)
---------+OPS.2.1.A9 Agreements on Connecting to Outsourcing Partner Networks (S)
---------+OPS.2.1.A10 Agreement on the Exchange of Data Between Outsourcing Partners (S)
---------+OPS.2.1.A11 Planning and Maintaining Information Security During Ongoing Outsourcing Operations (S)
---------+OPS.2.1.A12 Change Management [Process Owner] (S)
---------+OPS.2.1.A13 Secure Migration in Outsourcing Projects (S)
---------+OPS.2.1.A14 Contingency Planning for Outsourcing [BCM Officer] (S)
---------+OPS.2.1.A15 Organised Termination of an Outsourcing Relationship [Procurement Department] (S)
---------+OPS.2.1.A16 Security Vetting of Employees (H)
------+OPS.2.2 Cloud Usage
---------+OPS.2.2.G1. Insufficient Strategy for Cloud Use
---------+OPS.2.2.G2. Dependence on a Cloud Service Provider (Loss of Control)
---------+OPS.2.2.G3. Poor Compliance Management When Using the Cloud
---------+OPS.2.2.G4. Violations of Legal Provisions
---------+OPS.2.2.G5. Cloud Service Providers Offering Inadequate Multi-Client Capability
---------+OPS.2.2.G6. Inadequate Contractual Arrangements with a Cloud Service Provider
---------+OPS.2.2.G7. Lack of Planning of Migrations to Cloud Services
---------+OPS.2.2.G8. Inadequate Integration of Cloud Services into an Organisation's Own IT
---------+OPS.2.2.G9. Insufficient Provisions for Termination of Cloud Usage
---------+OPS.2.2.G10. Inadequate Administration Model for Cloud Use
---------+OPS.2.2.G11. Insufficient Contingency Planning Concept
---------+OPS.2.2.G12. Failure in the IT Systems of a Cloud Service Provider
---------+OPS.2.2.A1 Drawing Up a Strategy for Cloud Usage [Process Owner, Top Management, Data Protection Officer] (B)
---------+OPS.2.2.A2 Drawing Up a Security Policy for Cloud Usage [Process Owner] (B)
---------+OPS.2.2.A3 Service Definition for Cloud Services by the Customer [Process Owner] (B)
---------+OPS.2.2.A4 Definition of Areas of Responsibility and Interfaces [Process Owner] (B)
---------+OPS.2.2.A5 Planning a Secure Migration to a Cloud Service [Process Owner] (S)
---------+OPS.2.2.A6 Planning the Secure Integration of Cloud Services (S)
---------+OPS.2.2.A7 Drawing Up a Security Concept for Cloud Usage (S)
---------+OPS.2.2.A8 Careful Selection of a Cloud Service Provider [Top Management] (S)
---------+OPS.2.2.A9 Contractual Arrangements with the Cloud Service Provider [Top Management] (S)
---------+OPS.2.2.A10 Secure Migration to a Cloud Service [Process Owner] (S)
---------+OPS.2.2.A11 Drawing Up a Contingency Concept for a Cloud Service (S)
---------+OPS.2.2.A12 Maintaining Information Security During Live Cloud Operations (S)
---------+OPS.2.2.A13 Evidence of Sufficient Information Security for Cloud Usage (S)
---------+OPS.2.2.A14 Orderly Termination of a Cloud Service Relationship [Process Owner, Top Management] (S)
---------+OPS.2.2.A15 Ensuring the Portability of Cloud Services [Process Owner] (H)
---------+OPS.2.2.A16 Implementing In-House Backups [Process Owner] (H)
---------+OPS.2.2.A17 Use of Encryption When Using the Cloud (H)
---------+OPS.2.2.A18 Use of Federation Services [Process Owner] (H)
---------+OPS.2.2.A19 Security Vetting of Employees [Human Resources Department] (H)
------+OPS.3.1 Outsourcing for Service Providers
---------+OPS.3.1.G1. Failure of a Wide Area Network (WAN)
---------+OPS.3.1.G2. Insufficient Rules Regarding Information Security
---------+OPS.3.1.G3. Incorrect Administration of Site, System and Data Access Rights
---------+OPS.3.1.G4. Inadequate testing and approval procedures
---------+OPS.3.1.G5. Insecure transport of files and storage media
---------+OPS.3.1.G6. Insufficient information security management by the outsourcing service provider
---------+OPS.3.1.G7. Inadequate contractual arrangements with an outsourcing customer
---------+OPS.3.1.G8. Insufficient terms for the end of an outsourcing arrangement
---------+OPS.3.1.G9. Inadequate contingency planning for outsourcing
---------+OPS.3.1.G10. Failure of an outsourcing service provider’s systems
---------+OPS.3.1.G11. Vulnerabilities in the connection to an outsourcing service provider
---------+OPS.3.1.G12. Social engineering
---------+OPS.3.1.G13. Lack of multi-client capability with the outsourcing service provider
---------+OPS.3.1.A1 Drawing Up a Rough Concept for the Outsourcing Service (B)
---------+OPS.3.1.A2 Contractual Arrangements with Outsourcing Customers (S)
---------+OPS.3.1.A3 Creating a Security Concept for the Outsourcing Project (S)
---------+OPS.3.1.A4 Definition of Possible Communication Partners [Central Administration, Data Protection Officer] (S)
---------+OPS.3.1.A5 Provisions for Deploying the Personnel of Outsourcing Service Providers [Human Resources Department] (S)
---------+OPS.3.1.A6 Procedures Regarding the Use of Third-Party Personnel [Human Resources Department] (S)
---------+OPS.3.1.A7 Creation of a Client Separation Concept by an Outsourcing Service Provider (S)
---------+OPS.3.1.A8 Agreements on Connecting to Outsourcing Partner Networks (S)
---------+OPS.3.1.A9 Agreement on the Exchange of Data Between Outsourcing Partners (S)
---------+OPS.3.1.A10 Planning and Maintaining Information Security During Ongoing Outsourcing Operations (S)
---------+OPS.3.1.A11 Site, System, and Data Access Control [Central Administration] (S)
---------+OPS.3.1.A12 Change Management [Organisation] (S)
---------+OPS.3.1.A13 Secure Migration in Outsourcing Projects (S)
---------+OPS.3.1.A14 Contingency Planning for Outsourcing [BCM Officer] (S)
---------+OPS.3.1.A15 Orderly Termination of an Outsourcing Relationship [Top Management] (S)
---------+OPS.3.1.A16 Security Vetting of Employees [Human Resources Department] (H)
---+Detection and Response
------+DER.1 Detecting Security-Relevant Events
---------+DER.1.G1. Failure to Consider Statutory Provisions and Occupational Rights of Co-Determination
---------+DER.1.G2. Insufficient Employee Qualifications
---------+DER.1.G3. Improper Administration of the Detection Systems Used
---------+DER.1.G4. Lack of Information Regarding the Information Domain to be Protected
---------+DER.1.G5. Insufficient Use of Detection Systems
---------+DER.1.G6. Insufficient Personnel Resources
---------+DER.1.A1 Creation of a Security Policy for the Detection of Security-Relevant Events (B)
---------+DER.1.A2 Compliance with Legal Conditions When Analysing Log Data (B)
---------+DER.1.A3 Definition of Reporting Paths for Security-Relevant Events (B)
---------+DER.1.A4 Raising Employee Awareness [Supervisor, User, Employee] (B)
---------+DER.1.A5 Use of Detection Features Included in Systems [Process Owner] (B)
---------+DER.1.A6 Continuous Monitoring and Analysis of Log Data (S)
---------+DER.1.A7 Training of Responsible Persons [Supervisor] (S)
---------+DER.1.A9 Use of Additional Detection Systems [Process Owner] (S)
---------+DER.1.A10 Use of TLS/SSH Proxies [Process Owner] (S)
---------+DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)
---------+DER.1.A12 Evaluation of Information from External Sources [Process Owner] (S)
---------+DER.1.A13 Regular Audits of Detection Systems (S)
---------+DER.1.A14 Evaluation of Log Data by Specialised Personnel (H)
---------+DER.1.A15 Central Detection and Real-Time Examination of Event Messages (H)
---------+DER.1.A16 Use of Detection Systems in Accordance with Protection Requirements (H)
---------+DER.1.A17 Automatic Reaction to Security-Relevant Events (H)
---------+DER.1.A18 Performance of Regular Integrity Checks (H)
------+DER.2.1 Security Incident Handling
---------+DER.2.1.G1. Inappropriate Handling of Security Incidents
---------+DER.2.1.G2. Destruction of Evidence While Handling Security Incidents
---------+DER.2.1.A1 Definition of a Security Incident (B)
---------+DER.2.1.A2 Drawing Up a Policy for Handling Security Incidents (B)
---------+DER.2.1.A3 Specification of Responsibilities and Contact Persons in the Event of Security Incidents (B)
---------+DER.2.1.A4 Notification of Entities Affected by Security Incidents [Top Management, IT Operation Department, Data Protection Officer, BCM Officer] (B)
---------+DER.2.1.A5 Remedial Action in Connection with Security incidents [IT Operation Department] (B)
---------+DER.2.1.A6 Recovering the Operating Environment After Security Incidents [IT Operation Department] (B)
---------+DER.2.1.A7 Establishment of a Procedure for Handling Security Incidents [Top Management] (S)
---------+DER.2.1.A8 Design of Organisational Structures for Handling Security Incidents (S)
---------+DER.2.1.A9 Definition of Reporting Paths for Security Incidents (S)
---------+DER.2.1.A10 Limiting the Effects of Security Incidents [BCM Officer, IT Operation Department] (S)
---------+DER.2.1.A11 Classification of Security Incidents [IT Operation Department] (B)
---------+DER.2.1.A12 Specification of Where Security Incident Handling Overlaps with Fault Management [BCM Officer] (S)
---------+DER.2.1.A13 Integration into Security and Business Continuity Management [BCM Officer] (S)
---------+DER.2.1.A14 Escalation Strategy for Security Incidents [IT Operation Department] (S)
---------+DER.2.1.A15 Training Service Desk Employees [IT Operation Department] (S)
---------+DER.2.1.A16 Documentation for Remedying Security Incidents (S)
---------+DER.2.1.A17 Evaluation of Security Incidents (S)
---------+DER.2.1.A18 Further Development of Processes Based on Findings from Security Incidents and Industry Developments [Process Owner] (S)
---------+DER.2.1.A19 Specifying Priorities for Handling Security Incidents [Top Management] (H)
---------+DER.2.1.A20 Creation of a Dedicated Reporting Office for Security Incidents (H)
---------+DER.2.1.A21 Assembling a Team of Experts for Handling Security Incidents (H)
---------+DER.2.1.A22 Reviewing Management System Efficiency in Handling Security Incidents (H)
------+DER.2.2 Provisions for IT Forensics
---------+DER.2.2.G1. Violation of legal framework conditions
---------+DER.2.2.G2. Failure to Secure Evidence due to Incorrect or Incomplete Methods
---------+DER.2.2.A1 Examination of Legal and Regulatory Framework Conditions for Acquisition and Evaluation [Data Protection Officer, Top Management] (B)
---------+DER.2.2.A2 Drawing Up a Guide for Initial Measures in Case of an IT Security Incident (B)
---------+DER.2.2.A3 Pre-Selection of Forensic Service Providers (B)
---------+DER.2.2.A4 Identifying Common Areas Between IT Forensics and Crisis/Business Continuity Management (S)
---------+DER.2.2.A5 Drawing Up a Guide to Securing Evidence in Case of IT Security Incidents (S)
---------+DER.2.2.A6 Training Personnel on Forensic Securing of Evidence (S)
---------+DER.2.2.A7 Selecting Tools for Forensics (S)
---------+DER.2.2.A8 Selection and Order of Evidence to Be Secured [Process Owner] (S)
---------+DER.2.2.A9 Pre-Selection of Forensically Relevant Data [Process Owner] (S)
---------+DER.2.2.A10 Forensic Securing of IT Evidence [Process Owner] (S)
---------+DER.2.2.A11 Documentation of Securing Evidence [Process Owner] (S)
---------+DER.2.2.A12 Secure Storage of Original Storage Media and Evidence [Process Owner] (S)
---------+DER.2.2.A13 Framework Agreements with External Service Providers (H)
---------+DER.2.2.A14 Specifying Standard Procedures for Securing Evidence (H)
---------+DER.2.2.A15 Conducting Drills on Securing Evidence (H)
------+DER.2.3 Clean-Up of Extensive Security Incidents
---------+DER.2.3.G1. Incomplete Cleaning
---------+DER.2.3.G2. Destruction of Trace Evidence
---------+DER.2.3.G3. Premature Alerting of the Attacker
---------+DER.2.3.G4. Data Loss and Failure of IT Systems
---------+DER.2.3.G5. Lack of Network Restructuring after an APT Attack
---------+DER.2.3.A1 Creation of a Management Committee (B)
---------+DER.2.3.A2 Deciding on a Cleaning Strategy (B)
---------+DER.2.3.A3 Isolation of Affected Network Segments (B)
---------+DER.2.3.A4 Blocking and Changing Access Data and Cryptographic Keys (B)
---------+DER.2.3.A5 Closing the Initial Entry Route (B)
---------+DER.2.3.A6 Returning to Production Operations (B)
---------+DER.2.3.A7 Targeted System Hardening (S)
---------+DER.2.3.A8 Establishing Secure, Independent Communication Channels (S)
---------+DER.2.3.A9 Hardware Replacement in Affected IT Systems (H)
---------+DER.2.3.A10 Modifications to Help Thwart a Repeat Attack (H)
------+DER.3.1 Audits and Revisions
---------+DER.3.1.G1. Insufficient or Unplanned Implementation of Security Safeguards
---------+DER.3.1.G2. Ineffective or Inefficient Implementation of Security Safeguards
---------+DER.3.1.G3. Insufficient Implementation of the ISMS
---------+DER.3.1.G4. Insufficient Auditor Qualifications
---------+DER.3.1.G5. Lack of Long-Term Planning
---------+DER.3.1.G6. Lack of Planning and Coordination when Performing an Audit
---------+DER.3.1.G7. Lack of Coordination with Employee Representatives
---------+DER.3.1.G8. Deliberate Concealment of Deviations
---------+DER.3.1.A1 Definition of Responsibilities [Top Management] (B)
---------+DER.3.1.A2 Preparing an Audit or Revision (B)
---------+DER.3.1.A3 Conducting an Audit [Audit Team] (B)
---------+DER.3.1.A4 Performing a Revision (B)
---------+DER.3.1.A5 Integration into the Information Security Process (S)
---------+DER.3.1.A6 Definition of an Audit and Revision Basis and a Uniform Evaluation Scheme (S)
---------+DER.3.1.A7 Drawing Up an Audit Program (S)
---------+DER.3.1.A8 Creation of a Revision List (S)
---------+DER.3.1.A9 Selection of an Appropriate Audit Team or Revision Team (S)
---------+DER.3.1.A10 Creation of a Audit Plan or Revision Plan [Audit Team] (S)
---------+DER.3.1.A11 Communication and Behaviour During Audits [Audit Team] (S)
---------+DER.3.1.A12 Holding an Initial Meeting [Audit Team] (S)
---------+DER.3.1.A13 Inspection and Review of Documents [Audit Team] (S)
---------+DER.3.1.A14 Selection of Samples [Audit Team] (S)
---------+DER.3.1.A15 Selection of Appropriate Audit Techniques [Audit Team] (S)
---------+DER.3.1.A16 Schedule of the On-Site Audit [Audit Team] (S)
---------+DER.3.1.A17 Performance of the On-Site Audit [Audit Team] (S)
---------+DER.3.1.A18 Conducting Interviews [Audit Team] (S)
---------+DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)
---------+DER.3.1.A20 Holding a Closing Meeting [Audit Team] (S)
---------+DER.3.1.A21 Analysis of Audits [Audit Team] (S)
---------+DER.3.1.A22 Creation of an Audit Report [Audit Team] (S)
---------+DER.3.1.A23 Documentation of Revision Results (S)
---------+DER.3.1.A24 Conclusion of the Audit or Revision [Audit Team] (S)
---------+DER.3.1.A25 Evaluation of an Audit (S)
---------+DER.3.1.A26 Monitoring and Adapting the Audit Program (S)
---------+DER.3.1.A27 Storage and Archiving of Documents on Audits and Revisions (S)
------+DER.3.2 Audits Based on the BSI “Guideline for IS Audits”
---------+DER.3.2.G1. Violation of Specifications of UP Bund
---------+DER.3.2.G2. Suspension of Security Safeguards
---------+DER.3.2.G3. Ineffective or Inefficient Implementation of Security Safeguards
---------+DER.3.2.G4. Inadequate Implementation of the Information Security Management System
---------+DER.3.2.G5. Insufficient Auditor Qualifications
---------+DER.3.2.G6. Partiality of Internal IS Audit Teams
---------+DER.3.2.G7. Lack of Long-Term Planning
---------+DER.3.2.G8. Insufficient Planning and Coordination when Performing IS Audits
---------+DER.3.2.G9. Lack of Coordination with Employee Representatives
---------+DER.3.2.G10. Deliberate Concealment of Deviations or Problems
---------+DER.3.2.G11. Loss of Confidentiality of Sensitive Information
---------+DER.3.2.A1 Designation of Persons in Charge of the IS Audit [Top Management] (B)
---------+DER.3.2.A2 Creation of an IS Audit Manual (B)
---------+DER.3.2.A3 Definition of the Audit Basis (B)
---------+DER.3.2.A4 Drawing Up a Plan for the IS Audit (B)
---------+DER.3.2.A5 Selection of an Appropriate IS Audit Team (B)
---------+DER.3.2.A6 Preparation of an IS Audit [IS Audit Team] (B)
---------+DER.3.2.A7 Performance of an IS Audit [IS Audit Team] (B)
---------+DER.3.2.A8 Storage of IS Audit Reports (B)
---------+DER.3.2.A9 Integration into the Information Security Process (S)
---------+DER.3.2.A10 Communication Coordination (S)
---------+DER.3.2.A11 Holding an Initial Meeting for an IS Cross-Cutting Audit [IS Audit Team] (S)
---------+DER.3.2.A12 Creation of a Gap Analysis Plan [IS Audit Team] (S)
---------+DER.3.2.A13 Inspection and Review of Documents [IS Audit Team] (S)
---------+DER.3.2.A14 Selection of Target Objects and Requirements to Be Audited [IS Audit Team] (S)
---------+DER.3.2.A15 Selection of Appropriate Audit Techniques [IS Audit Team] (S)
---------+DER.3.2.A16 Creating a Procedure for the On-Site Audit [IS Audit Team] (S)
---------+DER.3.2.A17 Conducting the On-Site Audit [IS Audit Team] (S)
---------+DER.3.2.A18 Conducting Interviews [IS Audit Team] (S)
---------+DER.3.2.A19 Reviewing Risk Treatment Options [IS Audit Team] (S)
---------+DER.3.2.A20 Following Up on the On-Site Audit [IS Audit Team] (S)
---------+DER.3.2.A21 Creation of an IS Audit Report [IS Audit Team] (S)
---------+DER.3.2.A22 Following Up on an IS Audit (S)
------+DER.4 Business Continuity Management
---------+DER.4.G1. Shortage of Personnel
---------+DER.4.G2. Failure of IT Systems
---------+DER.4.G3. Failure of a Wide Area Network (WAN)
---------+DER.4.G4. Inability to Use a Building
---------+DER.4.G5. Unavailability of a Supplier or Service Provider
---------+DER.4.A1 Creating a Business Continuity Plan (S)
---------+DER.4.A2 Integration of Business Continuity Management and Information Security Management [Chief Information Security Officer (CISO)] (S)
---------+DER.4.A3 Specifying the Scope and the Business Continuity Strategy [Top Management] (H)
---------+DER.4.A4 Policy for Business Continuity Management and Acceptance of Overall Responsibility by Top Management [Top Management] (H)
---------+DER.4.A5 Establishing a Suitable Organisational Structure for Business Continuity Management [Top Management] (H)
---------+DER.4.A6 Providing Adequate Resources for Business Continuity Management [Top Management] (H)
---------+DER.4.A7 Creating a Contingency Concept [Top Management] (CIA)
---------+DER.4.A8 Integrating Employees into the Business Continuity Management Process [Supervisor, Human Resources Department] (H)
---------+DER.4.A9 Integrating Business Continuity Management into Organisation-Wide Procedures and Processes [Top Management] (H)
---------+DER.4.A10 Tests and Emergency Drills [Top Management] (H)
---------+DER.4.A12 Documentation in the Business Continuity Management Process (H)
---------+DER.4.A13 Checking and Controlling the Business Continuity Management System [Top Management] (H)
---------+DER.4.A14 Regular Checking and Improvement of Business Continuity Safeguards [Top Management] (H)
---------+DER.4.A15 Assessing the Performance of the Business Continuity Management System [Top Management] (H)
---------+DER.4.A16 Contingency Planning and Emergency Response Planning for Outsourced Components [Top Management] (H)
---+Applications
------+APP.1.1 Office Products
---------+APP.1.1.G1. Poor Adaptation of Office Products to an Organisation's Requirements
---------+APP.1.1.G2. Harmful Content in Office documents
---------+APP.1.1.G3. Loss of Integrity of Office Documents
---------+APP.1.1.A2 Limiting Active Content (B)
---------+APP.1.1.A3 Secure Opening of Documents from External Sources [User] (B)
---------+APP.1.1.A17 Awareness of Specific Office Properties (B)
---------+APP.1.1.A6 Testing New Versions of Office Products (S)
---------+APP.1.1.A10 Regulations for Software Development by End Users (S)
---------+APP.1.1.A11 Controlled Use of Extensions for Office Products (S)
---------+APP.1.1.A12 No Cloud Storage [User] (S)
---------+APP.1.1.A13 Use of Viewer Features [User] (S)
---------+APP.1.1.A14 Protection Against Subsequent Changes to Documents [User] (S)
---------+APP.1.1.A15 Use of Encryption and Digital Signatures (H)
---------+APP.1.1.A16 Checking Document Integrity (H)
------+APP.1.2 Web Browsers
---------+APP.1.2.G1. Execution of Malicious Code by Web Browsers
---------+APP.1.2.G2. Exploit Kits
---------+APP.1.2.G3. Eavesdropping on Internet Communications
---------+APP.1.2.G4. Loss of Integrity in Web Browsers
---------+APP.1.2.G5. Loss of Privacy
---------+APP.1.2.A1 Use of Basic Security Mechanisms (B)
---------+APP.1.2.A2 Support for Secure Communication Encryption (B)
---------+APP.1.2.A3 Use of Trusted Certificates (B)
---------+APP.1.2.A6 Password Management in Web Browsers (B)
---------+APP.1.2.A13 Use of DNS over HTTPS (B)
---------+APP.1.2.A7 Data Economy in Web Browsers [User] (S)
---------+APP.1.2.A9 Using an Isolated Web Browser Environment (H)
---------+APP.1.2.A10 Using the Private Mode [User] (H)
---------+APP.1.2.A11 Checking for Malicious Content (H)
---------+APP.1.2.A12 Two-Browser Strategy (H)
------+APP.1.4 Mobile Applications (Apps)
---------+APP.1.4.G1. Inappropriate Selection of apps
---------+APP.1.4.G2. Excessive Authorisations
---------+APP.1.4.G3. Undesired Functions in Apps
---------+APP.1.4.G4. Software Vulnerabilities and Errors in Apps
---------+APP.1.4.G5. Insecure storage of local application data
---------+APP.1.4.G6. Deriving Confidential Information from Metadata
---------+APP.1.4.G7. Leaks of Confidential Data
---------+APP.1.4.G8. Insecure Communication with Back-End Systems
---------+APP.1.4.G9. Communication Channels Beyond an Organisation’s Infrastructure
---------+APP.1.4.A1 Requirements Analysis for the Use of Apps [Process Owner] (B)
---------+APP.1.4.A5 Minimising and Checking App Authorisations [Process Owner] (B)
---------+APP.1.4.A7 Secure Storage of Local App Data (B)
---------+APP.1.4.A8 Preventing Data Leaks (B)
---------+APP.1.4.A3 Distributing Sensitive Apps (S)
---------+APP.1.4.A12 Secure App Removal (S)
---------+APP.1.4.A14 Support for Additional Authentication Features for Apps (H)
---------+APP.1.4.A15 Performing Penetration Tests for Apps (H)
---------+APP.1.4.A16 Mobile Application Management (H)
------+APP.2.1 General Directory Service
---------+APP.2.1.G1. Inadequate Planning of the Use of Directory Services
---------+APP.2.1.G2. Inadequate Planning of Partitioning and Replication in the Directory Service
---------+APP.2.1.G3. Inadequate Planning of Directory Service Access
---------+APP.2.1.G4. Incorrect Administration of System and Data Access Rights
---------+APP.2.1.G5. Errors in the Configuration of Directory Service Access
---------+APP.2.1.G6. Failure of Directory Services
---------+APP.2.1.G7. Infiltration of Directory Services due to Unauthorised Access
---------+APP.2.1.G8. Improper Configuration of Directory Services
---------+APP.2.1.A1 Creation of a Security Policy for Directory Services (B)
---------+APP.2.1.A2 Planning the Use of Directory Services [Data Protection Officer, Process Owner] (B)
---------+APP.2.1.A3 Setting Up Access Authorisations for Directory Services [Process Owner] (B)
---------+APP.2.1.A4 Secure Installation of Directory Services (B)
---------+APP.2.1.A5 Secure Configuration and Configuration Changes in Directory Services (B)
---------+APP.2.1.A6 Secure Operation of Directory Services (B)
---------+APP.2.1.A7 Drawing Up a Security Concept for the Use of Directory Services (S)
---------+APP.2.1.A8 Planning of Partitioning and Replication in the Directory Service (S)
---------+APP.2.1.A9 Selection of Suitable Components for Directory Services [Process Owner] (S)
---------+APP.2.1.A11 Setting Up Access to Directory Services (S)
---------+APP.2.1.A12 Monitoring Directory Services (S)
---------+APP.2.1.A13 Protection of Communications with Directory Services (S)
---------+APP.2.1.A14 Orderly Decommissioning of a Directory Service [Process Owner] (S)
---------+APP.2.1.A15 Migration of Directory Services (S)
---------+APP.2.1.A16 Creation of a Business Continuity Plan for Directory Service Failure (H)
------+APP.2.2 Active Directory
---------+APP.2.2.G1. Inadequate Planning of Security Boundaries
---------+APP.2.2.G2. Excessive or Negligent Trust Relationships
---------+APP.2.2.G3. Lack of Security Features due to Older Operating Systems and Domain Functional Level
---------+APP.2.2.G4. Operation of Additional Roles and Services on Domain Controllers
---------+APP.2.2.G5. Insufficient Monitoring and Documentation of Delegated Rights
---------+APP.2.2.G6. Insecure Authentication
---------+APP.2.2.G7. Overly Powerful or Insufficiently Secure Service Accounts
---------+APP.2.2.G8. Use of the Same Local Administrator Password on Multiple IT Systems
---------+APP.2.2.A1 Planning Active Directory [Process Owner] (B)
---------+APP.2.2.A2 Planning of Active Directory Administration [Process Owner] (B)
---------+APP.2.2.A3 Planning of Group Policy in Windows (B)
---------+APP.2.2.A5 Hardening Active Directory (B)
---------+APP.2.2.A6 Maintaining the Operational Continuity of Active Directory (B)
---------+APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)
---------+APP.2.2.A8 Configuration of Secure Channel in Windows (S)
---------+APP.2.2.A9 Authentication Protection When Using Active Directory (S)
---------+APP.2.2.A10 Secure Use of DNS for Active Directory (S)
---------+APP.2.2.A11 Monitoring Active Directory Infrastructure (S)
---------+APP.2.2.A12 Backups for Domain Controllers (S)
---------+APP.2.2.A14 Use of Dedicated Privileged Administration Systems (H)
---------+APP.2.2.A15 Separation of Administration and Production Environments (H)
------+APP.2.3 OpenLDAP
---------+APP.2.3.G1. Inadequate Planning of OpenLDAP
---------+APP.2.3.G2. Inadequate Separation of offline and online access to OpenLDAP
---------+APP.2.3.A1 Planning and Selecting Back Ends and Overlays for OpenLDAP (B)
---------+APP.2.3.A3 Secure Configuration of OpenLDAP (B)
---------+APP.2.3.A4 Configuration of the Database Used by OpenLDAP (B)
---------+APP.2.3.A5 Secure Assignment of Access Rights to OpenLDAP (B)
---------+APP.2.3.A6 Secure Authentication for OpenLDAP (B)
---------+APP.2.3.A8 Restrictions on Attributes in OpenLDAP (S)
---------+APP.2.3.A9 Partitioning and Replication in OpenLDAP (S)
---------+APP.2.3.A10 Secure Updating of OpenLDAP (S)
---------+APP.2.3.A11 Restriction of the OpenLDAP Runtime Environment (S)
------+APP.3.1 Web Applications and Web Services
---------+APP.3.1.G1. Insufficient Logging of Security-Relevant events
---------+APP.3.1.G2. Disclosure of Security-Relevant Information in Web Applications and Web Services
---------+APP.3.1.G3. Misuse of a Web Application Due to Automated Use
---------+APP.3.1.G4. Insufficient Authentication
---------+APP.3.1.A1 Authentication (B)
---------+APP.3.1.A4 Controlled Integration of Files and Content (B)
---------+APP.3.1.A7 Protection Against Unauthorised Automated Use (B)
---------+APP.3.1.A14 Protection of Confidential Data (B)
---------+APP.3.1.A8 System Architecture [Procurement Department] (S)
---------+APP.3.1.A9 Web Application and Web Service Procurement (S)
---------+APP.3.1.A11 Secure Integration of Background Systems (S)
---------+APP.3.1.A12 Secure Configuration (S)
---------+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)
---------+APP.3.1.A22 Penetration Testing and Auditing (S)
---------+APP.3.1.A20 Use of Web Application Firewalls (H)
------+APP.3.2 Web Servers
---------+APP.3.2.G1. Loss of Reputation
---------+APP.3.2.G2. Web Server Manipulation
---------+APP.3.2.G3. Denial of Service (DoS)
---------+APP.3.2.G4. Loss of Confidential Data
---------+APP.3.2.G5. Violation of Laws or Regulations
---------+APP.3.2.G6. Insufficient Troubleshooting
---------+APP.3.2.A1 Secure Web Server Configuration (B)
---------+APP.3.2.A2 Protection of Web Server Files (B)
---------+APP.3.2.A3 Protecting File Uploads and Downloads (B)
---------+APP.3.2.A4 Logging of Events (B)
---------+APP.3.2.A5 Authentication (B)
---------+APP.3.2.A7 Legal Framework Conditions for Websites [Process Owner, Central Administration, Compliance Manager] (B)
---------+APP.3.2.A11 Encryption via TLS (B)
---------+APP.3.2.A8 Planning the Use of a Web Server (S)
---------+APP.3.2.A9 Defining a Web Server Security Policy (S)
---------+APP.3.2.A10 Selecting an Appropriate Web Host (S)
---------+APP.3.2.A12 Suitable Handling of Errors and Error Messages (S)
---------+APP.3.2.A13 Access Control for Web Crawlers (S)
---------+APP.3.2.A14 Integrity Checks and Protection Against Malware (S)
---------+APP.3.2.A16 Penetration Testing and Auditing (S)
---------+APP.3.2.A20 Appointing Contact Persons [Central Administration] (S)
---------+APP.3.2.A15 Redundancy (H)
---------+APP.3.2.A18 Protection Against Denial-of-Service Attacks (H)
------+APP.3.3 File Servers
---------+APP.3.3.G1. File Server Failure
---------+APP.3.3.G2. Insufficient File Server Characteristics
---------+APP.3.3.G3. Insufficient Checking of Stored Files
---------+APP.3.3.G4. Insufficient Access Authorisation Concept
---------+APP.3.3.G5. Unstructured Data Storage
---------+APP.3.3.G6. Loss of Data Stored on File Servers
---------+APP.3.3.G7. Ransomware
---------+APP.3.3.A2 Use of RAID Systems (B)
---------+APP.3.3.A3 Use of Anti-Virus Programs (B)
---------+APP.3.3.A15 Planning File Servers (B)
---------+APP.3.3.A6 Acquiring a File Server and Selecting a Service (S)
---------+APP.3.3.A7 Selecting a File System (S)
---------+APP.3.3.A8 Structured Data Storage [User] (S)
---------+APP.3.3.A9 Secure Storage Management (S)
---------+APP.3.3.A11 Using Storage Restrictions (S)
---------+APP.3.3.A14 Using Error Correction Codes (S)
---------+APP.3.3.A12 Data Encryption (H)
---------+APP.3.3.A13 Replicating Between Locations (H)
------+APP.3.4 Samba
---------+APP.3.4.G1. Eavesdropping on Unprotected Samba Communication Links
---------+APP.3.4.G2. Insecure Default Settings on Samba Servers
---------+APP.3.4.G3. Unauthorised Use or Administration of Samba
---------+APP.3.4.G4. Incorrect Administration of Samba
---------+APP.3.4.G5. Data Loss in Samba Environments
---------+APP.3.4.G6. Loss of Integrity of Sensitive Information in Samba Environments
---------+APP.3.4.A1 Planning the Use of a Samba Server (B)
---------+APP.3.4.A2 Secure Basic Configuration of a Samba Server (B)
---------+APP.3.4.A3 Secure Configuration of a Samba Server (S)
---------+APP.3.4.A4 Avoiding NTFS File Properties on a Samba Server (S)
---------+APP.3.4.A5 Secure Configuration of a Samba Server's Access Controls (S)
---------+APP.3.4.A6 Secure Configuration of Winbind in Samba (S)
---------+APP.3.4.A7 Secure DNS Configuration in Samba (S)
---------+APP.3.4.A8 Secure LDAP Configuration in Samba (S)
---------+APP.3.4.A9 Secure Configuration of Kerberos in Samba (S)
---------+APP.3.4.A10 Secure Use of External Programs on a Samba Server (S)
---------+APP.3.4.A12 Training Samba Server Administrators (S)
---------+APP.3.4.A13 Regular Backups of Important Samba Server Components (S)
---------+APP.3.4.A15 Encryption of Data Packets in Samba (H)
------+APP.3.6 DNS Servers
---------+APP.3.6.G1. DNS Server Failure
---------+APP.3.6.G2. Inadequate Line Bandwidth
---------+APP.3.6.G3. Inadequate planning of DNS usage
---------+APP.3.6.G4. Incorrect Domain Information
---------+APP.3.6.G5. Incorrect Configuration of a DNS Server
---------+APP.3.6.G6. DNS Manipulation
---------+APP.3.6.G7. DNS Hijacking
---------+APP.3.6.G8. DNS DoS
---------+APP.3.6.G9. DNS Reflection
---------+APP.3.6.A1 Planning the Use of VPNs (B)
---------+APP.3.6.A2 Deployment of Redundant DNS Servers (B)
---------+APP.3.6.A3 Use of Separate DNS Servers for Internal and External Requests (B)
---------+APP.3.6.A4 Secure Basic Configuration of a DNS Server (B)
---------+APP.3.6.A6 Securing Dynamic DNS Updates (B)
---------+APP.3.6.A7 Monitoring of DNS Servers (B)
---------+APP.3.6.A8 Administration of Domain Names [Central Administration] (B)
---------+APP.3.6.A9 Creation of a Business Continuity Plan for DNS Servers (B)
---------+APP.3.6.A10 Selection of a Suitable DNS Server Product (S)
---------+APP.3.6.A11 Sufficient Capacity of DNS Servers (S)
---------+APP.3.6.A13 Limited Visibility of Domain Information (S)
---------+APP.3.6.A14 Location of Name Servers (S)
---------+APP.3.6.A15 Analysis of Log Data (S)
---------+APP.3.6.A16 Integrating a DNS Server into a “P-A-P” Structure (S)
---------+APP.3.6.A17 Use of DNSSEC (S)
---------+APP.3.6.A18 Advanced Securing of Zone Transfers (S)
---------+APP.3.6.A19 Disposal of DNS Servers (S)
---------+APP.3.6.A20 Feasibility Reviews of Business Continuity Plans (H)
---------+APP.3.6.A21 Hidden Master (H)
---------+APP.3.6.A22 Connecting DNS Servers via Different Providers (H)
------+APP.4.2 SAP ERP Systems
---------+APP.4.2.G1. Lack of Consideration of SAP Security Recommendations
---------+APP.4.2.G2. Insufficient Application of Patches and SAP Security Notes
---------+APP.4.2.G3. Lack of Planning, Implementation, and Documentation of an SAP Access Control Policy
---------+APP.4.2.G4. Lack of SAP Documentation and Contingency Concepts
---------+APP.4.2.A1 Secure Configuration of the SAP Java Stack (B)
---------+APP.4.2.A2 Secure Configuration of the SAP Java Stack (B)
---------+APP.4.2.A3 Network Security (B)
---------+APP.4.2.A4 Protection of Standard SAP User IDs (B)
---------+APP.4.2.A5 Configuration and Protection of SAP User Administration (B)
---------+APP.4.2.A6 Creation and Implementation of a User and Access Control Policy [Department, Developer] (B)
---------+APP.4.2.A7 Protection of SAP Databases (B)
---------+APP.4.2.A8 Protection of the SAP RFC Interface (B)
---------+APP.4.2.A9 Protecting and Monitoring the Message Server (B)
---------+APP.4.2.A11 Secure Installation of an SAP ERP System (S)
---------+APP.4.2.A12 SAP Authorisation Development [Department, Developer] (S)
---------+APP.4.2.A13 SAP Password Security (S)
---------+APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)
---------+APP.4.2.A15 Secure Configuration of the SAP Router (S)
---------+APP.4.2.A16 Implementation of Security Requirements for the Windows Operating System (S)
---------+APP.4.2.A17 Implementation of Security Requirements for the Unix Operating System (S)
---------+APP.4.2.A18 Disabling Insecure Communications (S)
---------+APP.4.2.A19 Definition of Security Policies for Users (S)
---------+APP.4.2.A20 Secure SAP GUI Settings (S)
---------+APP.4.2.A22 Protection of the Spool in the SAP ERP System [Developer] (S)
---------+APP.4.2.A23 Protection of SAP Background Processing [Developer] (S)
---------+APP.4.2.A24 Activation and Protection of the Internet Communication Framework (S)
---------+APP.4.2.A25 Secure Configuration of the SAP Web Dispatcher (S)
---------+APP.4.2.A26 Protection of Customers' Own Code in the SAP ERP System (S)
---------+APP.4.2.A27 Auditing the SAP ERP System [Department] (S)
---------+APP.4.2.A28 Creation of a Contingency Concept [BCM Officer] (S)
---------+APP.4.2.A29 Setting Up Emergency Users (S)
---------+APP.4.2.A30 Implementation of Continuous Monitoring of Security Settings (S)
---------+APP.4.2.A31 Configuration of SAP Single Sign-On (S)
---------+APP.4.2.A32 Real-Time Detection and Alerts for Irregular Processes (H)
------+APP.4.3 Relational Database Systems
---------+APP.4.3.G1. Insufficient System Resources
---------+APP.4.3.G2. Enabled Default User Accounts
---------+APP.4.3.G3. Unencrypted Database Connections
---------+APP.4.3.G4. Data Loss in a Database
---------+APP.4.3.G5. Loss of Integrity of Stored Data
---------+APP.4.3.G6. SQL Injections
---------+APP.4.3.G7. Insecure Configuration of the Database Management System
---------+APP.4.3.G8. Malware and Insecure Database Scripts
---------+APP.4.3.A1 Creation of a Security Policy for Database Systems (B)
---------+APP.4.3.A3 Basic Hardening of Database Management Systems (B)
---------+APP.4.3.A4 Controlled Creation of New Databases (B)
---------+APP.4.3.A9 Backing Up a Database System (B)
---------+APP.4.3.A11 Sufficient Hardware Capacity [Process Owner] (S)
---------+APP.4.3.A12 Uniform Configuration Standard for Database Management Systems (S)
---------+APP.4.3.A13 Restrictive Utilisation of Database Links (S)
---------+APP.4.3.A16 Encryption of Database Connections (S)
---------+APP.4.3.A17 Data Transfer or Migration [Process Owner] (S)
---------+APP.4.3.A18 Database Management System Monitoring (S)
---------+APP.4.3.A19 Protection Against Malicious Database Scripts [Developer] (S)
---------+APP.4.3.A20 Regular Audits (S)
---------+APP.4.3.A21 Use of Database Security Tools (H)
---------+APP.4.3.A22 Contingency Planning (H)
---------+APP.4.3.A23 Archiving (H)
---------+APP.4.3.A24 Data Encryption in Databases (H)
---------+APP.4.3.A25 Security Audits of Database Systems (H)
------+APP.4.4 Kubernetes
---------+APP.4.4.G1. Poor Authentication and Authorisation in the Control Plane
---------+APP.4.4.G2. Loss of Confidentiality of Access Data
---------+APP.4.4.G3. Resource Conflicts on Nodes
---------+APP.4.4.G4. Unauthorised Changes to Clusters
---------+APP.4.4.G5. Unauthorised Communication
---------+APP.4.4.A1 Planning the Separation of the Applications (B)
---------+APP.4.4.A2 Planning Automation with CI/CD (B)
---------+APP.4.4.A3 Identity and Access Management for Kubernetes (B)
---------+APP.4.4.A4 Separation of Pods (B)
---------+APP.4.4.A5 Backup in the Cluster (B)
---------+APP.4.4.A6 Initialisation of Pods (S)
---------+APP.4.4.A7 Separation of Networks for Kubernetes (S)
---------+APP.4.4.A8 Securing Configuration Files on Kubernetes (S)
---------+APP.4.4.A9 Use of Kubernetes Service Accounts (S)
---------+APP.4.4.A10 Securing Automation Processes (S)
---------+APP.4.4.A11 Container Monitoring (S)
---------+APP.4.4.A12 Securing Infrastructure Applications (S)
---------+APP.4.4.A13 Automated Configuration Auditing (H)
---------+APP.4.4.A14 Use of Dedicated Nodes (H)
---------+APP.4.4.A15 Separation of Applications at Node and Cluster Level (H)
---------+APP.4.4.A16 Use of Operators (H)
---------+APP.4.4.A17 Attestation of Nodes (H)
---------+APP.4.4.A18 Use of Micro-Segmentation (H)
---------+APP.4.4.A19 High Availability of Kubernetes (H)
---------+APP.4.4.A20 Encrypted Data Storage for Pods (H)
---------+APP.4.4.A21 Regular Restart of Pods (H)
------+APP.4.6 SAP ABAP Programming
---------+APP.4.6.G1. Lack of Authorisation Checks
---------+APP.4.6.G2. Loss of Confidentiality or Integrity of Critical Data
---------+APP.4.6.G3. Injection Vulnerabilities
---------+APP.4.6.G4. Bypassing Existing SAP Security Mechanisms
---------+APP.4.6.A1 Protecting Reports with Authorisation Checks (B)
---------+APP.4.6.A2 Formally Correct Evaluation of Authorisation Checks (B)
---------+APP.4.6.A3 Authorisation Check Before Starting a Transaction (B)
---------+APP.4.6.A4 No Proprietary Authorisation Checks (B)
---------+APP.4.6.A5 Drawing Up a Policy for ABAP Development (S)
---------+APP.4.6.A6 Complete Execution of Authorisation Checks (S)
---------+APP.4.6.A7 Authorisation Check During Input Processing (S)
---------+APP.4.6.A8 Protection Against Unauthorised or Manipulative Access to the File System (S)
---------+APP.4.6.A9 Authorisation Check in Remote-Enabled Function Modules (S)
---------+APP.4.6.A10 Execution of Operating System Commands (S)
---------+APP.4.6.A11 Avoiding Planted Malicious Code (S)
---------+APP.4.6.A12 Avoiding Generic Module Execution (S)
---------+APP.4.6.A13 Avoiding Generic Access to Table Contents (S)
---------+APP.4.6.A14 Avoiding Native SQL Statements (S)
---------+APP.4.6.A15 Avoiding Data Leaks (S)
---------+APP.4.6.A16 No System-Dependent Execution of Functions (S)
---------+APP.4.6.A17 No Client-Dependent Execution of Functions (S)
---------+APP.4.6.A18 Avoiding Open SQL Injection Vulnerabilities (S)
---------+APP.4.6.A19 Protection Against Cross-Site Scripting (S)
---------+APP.4.6.A20 No Access to Data from Another Client (S)
---------+APP.4.6.A21 Ban on Hidden ABAP Source Code (S)
---------+APP.4.6.A22 Use of ABAP Code Analysis Tools (H)
------+APP.5.2 Microsoft Exchange and Outlook
---------+APP.5.2.G1. Insufficient Rules for Exchange and Outlook
---------+APP.5.2.G2. Incorrect Migration of Exchange
---------+APP.5.2.G3. Inadmissible Browser Access to Exchange
---------+APP.5.2.G4. Unauthorised Connection of Other Systems to Exchange
---------+APP.5.2.G5. Improper Administration of Site and Data Access Rights in Exchange and Outlook
---------+APP.5.2.G6. Incorrect Configuration of Exchange
---------+APP.5.2.G7. Improper Configuration of Outlook
---------+APP.5.2.G8. Malfunction and Misuse of In-House Macros and Programming Interfaces in Outlook
---------+APP.5.2.A1 Planning the Use of Exchange and Outlook (B)
---------+APP.5.2.A2 Selecting an Exchange Infrastructure (B)
---------+APP.5.2.A3 Access Management and Access Rights (B)
---------+APP.5.2.A5 Backing Up Exchange (B)
---------+APP.5.2.A7 Migration of Exchange Systems (S)
---------+APP.5.2.A9 Secure Configuration of Exchange Servers (S)
---------+APP.5.2.A10 Secure Configuration of Outlook (S)
---------+APP.5.2.A11 Protection of Communications Between Exchange Systems (S)
---------+APP.5.2.A12 Using Outlook Anywhere, MAPI over HTTP, and Outlook on the Web (S)
---------+APP.5.2.A17 Encryption of Exchange Database Files (H)
------+APP.5.3 General E-Mail Clients and Servers
---------+APP.5.3.G1. Insufficient Planning of E-Mail Use
---------+APP.5.3.G2. Incorrect Configuration of E-Mail Clients and Servers
---------+APP.5.3.G3. E-mail Unreliability
---------+APP.5.3.G4. Malware in E-Mails
---------+APP.5.3.G5. Social engineering
---------+APP.5.3.G6. Reading and Manipulating E-Mails
---------+APP.5.3.A1 Secure Configuration of E-Mail Clients (B)
---------+APP.5.3.A2 Secure Operation of E-Mail Servers (B)
---------+APP.5.3.A3 Data Backup and Archiving of E-Mails (B)
---------+APP.5.3.A4 Spam and Virus Protection on E-Mail Servers (B)
---------+APP.5.3.A5 Establishing Deputising Rules for E-Mail Use [Supervisor] (S)
---------+APP.5.3.A6 Defining a Security Policy for E-Mail (S)
---------+APP.5.3.A7 User Training on the Security Mechanisms of E-Mail Clients (S)
---------+APP.5.3.A8 Training Users to Deal with Spam [User] (S)
---------+APP.5.3.A9 Extended Security Safeguards on E-Mail Servers (S)
---------+APP.5.3.A10 End-to-End Encryption (H)
---------+APP.5.3.A11 Deployment of Redundant E-Mail Servers (H)
---------+APP.5.3.A12 Monitoring Public Blacklists (H)
---------+APP.5.3.A13 TLS Reporting (H)
------+APP.6 General Software
---------+APP.6.G1. Inappropriate Selection of Software
---------+APP.6.G2. Disclosure of Sensitive Information Due to Incorrect Configuration
---------+APP.6.G3. Purchasing Software from Unreliable Sources
---------+APP.6.G4. Security Vulnerabilities Due to Inadequate Maintenance
---------+APP.6.G5. Data Loss Due to Incorrect Use of Software
---------+APP.6.G6. Insufficient Resources for Running Software
---------+APP.6.G7. Failure to Meet User Requirements
---------+APP.6.A1 Planning Software Use [Process Owner] (B)
---------+APP.6.A2 Drawing Up a Requirements Catalogue for Software [Process Owner] (B)
---------+APP.6.A3 Secure Procurement of Software [Procurement Department] (B)
---------+APP.6.A4 Regulation of Software Installation and Configuration [Process Owner] (B)
---------+APP.6.A5 Secure Installation of Software (B)
---------+APP.6.A6 Consideration of Recommended Security Requirements (S)
---------+APP.6.A7 Selection and Assessment of Potential Software [Process Owner, Procurement Department] (S)
---------+APP.6.A8 Regulation of the Availability of Installation Files (S)
---------+APP.6.A9 Taking Inventory of Software (S)
---------+APP.6.A10 Establishing a Security Policy for Software Use (S)
---------+APP.6.A11 Using Plug-ins and Extensions (S)
---------+APP.6.A12 Orderly Decommissioning of Software [Process Owner] (S)
---------+APP.6.A13 Uninstallation of Software (S)
---------+APP.6.A14 Using Certified Software (H)
------+APP.7 Development of Individual Software
---------+APP.7.G1. Unsatisfactory Contractual Arrangements with External Service Providers
---------+APP.7.G2. Software Design Errors
---------+APP.7.G3. Undocumented Functions
---------+APP.7.G4. Insufficient Security Safeguards in Applications
---------+APP.7.G5. Inadequate Control of Software Development
---------+APP.7.G6. Hiring Unsuitable Software Developers
---------+APP.7.A1 Including Aspects of Individual Software in Software Deployment Planning (B)
---------+APP.7.A2 Defining Security Requirements for the Software Development Process (B)
---------+APP.7.A3 Specification of Security Functions for System Integration [IT Operation Department] (B)
---------+APP.7.A4 Commissioning in Line with Requirements [Procurement Department] (B)
---------+APP.7.A5 Appropriate Control of Application Development (S)
---------+APP.7.A6 Documentation of Individual Software Requirements (S)
---------+APP.7.A7 Secure Acquisition of Individual Software (S)
---------+APP.7.A8 Early Involvement of the Process Owner in Development-Related Software Tests (S)
---------+APP.7.A9 Trusted Storage (H)
---------+APP.7.A10 Commissioning Certified Software Development Companies (H)
---+IT Systems
------+SYS.1.1 General Server
---------+SYS.1.1.G1. Data Loss
---------+SYS.1.1.G2. Denial-of-Service Attacks
---------+SYS.1.1.G3. Provision of Unnecessary Operating System Components and Applications
---------+SYS.1.1.G4. Server Overload
---------+SYS.1.1.A1 Appropriate Installation (B)
---------+SYS.1.1.A2 User Authentication on Servers (B)
---------+SYS.1.1.A5 Protection of Interfaces (B)
---------+SYS.1.1.A6 Disabling Unnecessary Services (B)
---------+SYS.1.1.A9 Using Anti-Virus Programs on Servers (B)
---------+SYS.1.1.A10 Logging (B)
---------+SYS.1.1.A11 Defining a Security Policy for Servers (S)
---------+SYS.1.1.A12 Planning the Use of Servers (S)
---------+SYS.1.1.A13 Procurement of Servers (S)
---------+SYS.1.1.A15 Stable and Uninterruptible Power Supply [Building Services] (S)
---------+SYS.1.1.A16 Secure Basic Configuration of Servers (S)
---------+SYS.1.1.A19 Configuring Local Packet Filters (S)
---------+SYS.1.1.A21 Operational Documentation for Servers (S)
---------+SYS.1.1.A22 Integration into Contingency Planning (S)
---------+SYS.1.1.A23 Monitoring Systems and Servers (S)
---------+SYS.1.1.A24 Security Checks for Servers (S)
---------+SYS.1.1.A25 Controlled Decommissioning of a Server (S)
---------+SYS.1.1.A35 Drawing Up and Maintaining an Operating Manual (S)
---------+SYS.1.1.A37 Encapsulation of Security-Critical Applications and Operating System Components (S)
---------+SYS.1.1.A27 Host-Based Attack Detection (H)
---------+SYS.1.1.A28 Increasing Availability Through Redundancy (H)
---------+SYS.1.1.A30 One Service per Server (H)
---------+SYS.1.1.A31 Using Execution Control (H)
---------+SYS.1.1.A33 Active Administration of Root Certificates (H)
---------+SYS.1.1.A34 Hard Disk Encryption (H)
---------+SYS.1.1.A36 Protecting the Boot Process (H)
---------+SYS.1.1.A38 Hardening of the Host System by Means of a Read-Only File System (H)
------+SYS.1.2.2 Windows Server 2012
---------+SYS.1.2.2.G1. Poor Planning of Windows Server 2012
---------+SYS.1.2.2.G2. Careless Cloud usage
---------+SYS.1.2.2.G3. Improper Administration of Windows Servers
---------+SYS.1.2.2.G4. Improper Use of Group Policies (GPOs)
---------+SYS.1.2.2.G5. Loss of Integrity of Sensitive Information or Processes
---------+SYS.1.2.2.G6. Unauthorised Acquisition or Misuse of Administrator Rights
---------+SYS.1.2.2.G7. Compromised Remote Access
---------+SYS.1.2.2.A1 Planning of Windows Server 2012 (B)
---------+SYS.1.2.2.A2 Secure Installation of Windows Server 2012 (B)
---------+SYS.1.2.2.A3 Secure Administration of Windows Server 2012 (B)
---------+SYS.1.2.2.A4 Secure Configuration of Windows Server 2012 (S)
---------+SYS.1.2.2.A5 Protection Against Malware on Windows Server 2012 (S)
---------+SYS.1.2.2.A6 Secure Authentication and Authorisation in Windows Server 2012 (S)
---------+SYS.1.2.2.A8 Protection of System Integrity (S)
---------+SYS.1.2.2.A11 Attack Detection in Windows Server 2012 (H)
---------+SYS.1.2.2.A12 Redundancy and High Availability in Windows Server 2012 (H)
---------+SYS.1.2.2.A14 Shutting Down Encrypted Servers and Virtual Machines (H)
------+SYS.1.3 Linux and Unix Servers
---------+SYS.1.3.G1. Unauthorised Collection of System and User Information
---------+SYS.1.3.G2. Exploitability of the Script Environment
---------+SYS.1.3.G3. Dynamic Loading of Jointly Used Libraries
---------+SYS.1.3.G4. Software from Third-Party Sources
---------+SYS.1.3.A2 Careful Allocation of IDs (B)
---------+SYS.1.3.A3 No Automatic Integration of Removable Drives (B)
---------+SYS.1.3.A4 Protection from Exploitation of Vulnerabilities in Applications (B)
---------+SYS.1.3.A5 Secure Installation of Software Packages (B)
---------+SYS.1.3.A6 Managing Users and Groups (S)
---------+SYS.1.3.A8 Encrypted Access via Secure Shell (S)
---------+SYS.1.3.A10 Preventing Further Intrusion When Vulnerabilities Are Exploited (S)
---------+SYS.1.3.A14 Preventing Unauthorised Collection of System and User Information (H)
---------+SYS.1.3.A16 Additional Prevention of Further Intrusion When Vulnerabilities Are Exploited (H)
---------+SYS.1.3.A17 Additional Kernel Protection (H)
------+SYS.1.5 Virtualisation
---------+SYS.1.5.G1. Poor Planning of Virtualisation
---------+SYS.1.5.G2. Poor Configuration of Virtualisation
---------+SYS.1.5.G3. Insufficient Resources for Virtual IT Systems
---------+SYS.1.5.G4. Information Leaks or Resource Bottlenecks due to Snapshots
---------+SYS.1.5.G5. Failure of the Administration Server for Virtualisation Systems
---------+SYS.1.5.G6. Misuse of Guest Tools
---------+SYS.1.5.G7. Compromised Virtualisation Software
---------+SYS.1.5.A2 Secure Use of Virtual IT Systems (B)
---------+SYS.1.5.A3 Secure Configuration of Virtual IT Systems (B)
---------+SYS.1.5.A4 Secure Configuration of a Network for Virtual Infrastructures (B)
---------+SYS.1.5.A5 Protection of Administration Interfaces (B)
---------+SYS.1.5.A6 Logging in the Virtual Infrastructure (B)
---------+SYS.1.5.A7 Time Synchronisation in Virtual IT Systems (B)
---------+SYS.1.5.A8 Planning a Virtual Infrastructure [Planner] (S)
---------+SYS.1.5.A9 Network Planning for Virtual Infrastructure [Planner] (S)
---------+SYS.1.5.A10 Introduction of Management Processes for Virtual IT Systems (S)
---------+SYS.1.5.A11 Administration of the Virtualisation Infrastructure Using a Separate Management Network (S)
---------+SYS.1.5.A12 Rights and Role Concept for Virtual Infrastructure Administration (S)
---------+SYS.1.5.A13 Selection of Suitable Hardware for Virtualisation Environments (S)
---------+SYS.1.5.A14 Uniform Configuration Standards for Virtual IT Systems (S)
---------+SYS.1.5.A15 Operation of Guest Operating Systems with Different Protection Needs (S)
---------+SYS.1.5.A16 Encapsulation of Virtual Machines (S)
---------+SYS.1.5.A17 Monitoring the Operating Condition and Configuration of the Virtual Infrastructure (S)
---------+SYS.1.5.A19 Regular Audits of Virtualisation Infrastructure (S)
---------+SYS.1.5.A20 Using Highly Available Architectures [Planner] (H)
---------+SYS.1.5.A21 Secure Configuration of Virtual IT Systems for Increased Protection Needs (H)
---------+SYS.1.5.A22 Hardening of the Virtualisation Server (H)
---------+SYS.1.5.A23 Restriction of Rights of Virtual Machines (H)
---------+SYS.1.5.A24 Disabling Snapshots of Virtual IT Systems (H)
---------+SYS.1.5.A25 Minimal Use of Console Access to Virtual IT Systems (H)
---------+SYS.1.5.A26 Use of a PKI [Planner] (H)
---------+SYS.1.5.A27 Use of Certified Virtualisation Software (H)
---------+SYS.1.5.A28 Encryption of Virtual IT Systems (H)
------+SYS.1.6 Containerisation
---------+SYS.1.6.G1. Vulnerabilities or Malware in Images
---------+SYS.1.6.G2. Administrative Access Without Security
---------+SYS.1.6.G3. Resource Conflicts on the Host
---------+SYS.1.6.G4. Unauthorised Communication
---------+SYS.1.6.G5. Breaking Out of the Container into the Host System
---------+SYS.1.6.G6. Data Loss Through Container Management
---------+SYS.1.6.G7. Loss of Confidentiality of Access Data
---------+SYS.1.6.G8. Disorderly Provision and Distribution of Images
---------+SYS.1.6.A1 Planning Container Use (B)
---------+SYS.1.6.A2 Container Management Planning (B)
---------+SYS.1.6.A3 Secure Use of Containerised IT Systems (B)
---------+SYS.1.6.A4 Planning the Provision and Distribution of Images (B)
---------+SYS.1.6.A5 Separation of Administration and Access Networks for Containers (B)
---------+SYS.1.6.A6 Use of Secure Images (B)
---------+SYS.1.6.A7 Persistence of Container Logging Data (B)
---------+SYS.1.6.A8 Secure Storage of Container Access Data (B)
---------+SYS.1.6.A9 Suitability for Container Operation (S)
---------+SYS.1.6.A10 Policy for Images and Container Operation (S)
---------+SYS.1.6.A11 Only One Service per Container (S)
---------+SYS.1.6.A12 Distribution of Secure Images (S)
---------+SYS.1.6.A13 Release of Images (S)
---------+SYS.1.6.A14 Updating Images (S)
---------+SYS.1.6.A15 Limitation of Resources per Container (S)
---------+SYS.1.6.A16 Administrative Remote Access to Containers (S)
---------+SYS.1.6.A17 Running Containers Without Privileges (S)
---------+SYS.1.6.A18 Application Services Accounts (S)
---------+SYS.1.6.A19 Including Data Stores in Containers (S)
---------+SYS.1.6.A20 Protection of Configuration Data (S)
---------+SYS.1.6.A21 Extended Security Policies (H)
---------+SYS.1.6.A22 Provision for Investigations (H)
---------+SYS.1.6.A23 Container Immutability (H)
---------+SYS.1.6.A24 Host-Based Attack Detection (H)
---------+SYS.1.6.A25 High Availability of Containerised Applications (H)
---------+SYS.1.6.A26 Advanced Isolation and Encapsulation of Containers (H)
------+SYS.1.7 IBM Z
---------+SYS.1.7.G1. Inadequate or Incorrect Configuration of Hardware or the z/OS Operating System
---------+SYS.1.7.G2. Incorrect Configuration of the z/OS Security System RACF
---------+SYS.1.7.G3. Incorrect Use of z/OS System Functions
---------+SYS.1.7.G4. Manipulation of the z/OS System Configuration
---------+SYS.1.7.G5. Attacks on z/OS Systems Using TCP/IP
---------+SYS.1.7.G6. Incorrect Character Conversion When Using z/OS
---------+SYS.1.7.A1 Use of Restrictive z/OS IDs (B)
---------+SYS.1.7.A2 Protection of Security-Critical z/OS Utilities (B)
---------+SYS.1.7.A3 Maintenance of Z Systems (B)
---------+SYS.1.7.A4 Training z/OS Operators [Supervisor] (B)
---------+SYS.1.7.A5 Use and Protection of System-Related z/OS Terminals (B)
---------+SYS.1.7.A6 Use and Protection of the Remote Support Facility (B)
---------+SYS.1.7.A7 Restrictive Authorisation in z/OS (B)
---------+SYS.1.7.A8 Use of the z/OS Security System RACF (B)
---------+SYS.1.7.A9 Multi-Client Capability in z/OS (B)
---------+SYS.1.7.A11 Protection of Session Data (B)
---------+SYS.1.7.A14 Reporting on the Secure Operation of z/OS (S)
---------+SYS.1.7.A16 Monitoring of z/OS Systems (S)
---------+SYS.1.7.A17 Synchronisation of z/OS Passwords and RACF Commands (S)
---------+SYS.1.7.A18 Role Concept for z/OS Systems (S)
---------+SYS.1.7.A19 Protection of z/OS Transaction Monitors (S)
---------+SYS.1.7.A20 Decommissioning z/OS Systems (S)
---------+SYS.1.7.A21 Protection of the Startup Process of z/OS Systems (S)
---------+SYS.1.7.A22 Protection of the Operating Functions of z/OS (S)
---------+SYS.1.7.A23 Protection of z/VM (S)
---------+SYS.1.7.A24 Administration of Storage Media in z/OS Systems (S)
---------+SYS.1.7.A25 Stipulation of z/OS System Capacity (S)
---------+SYS.1.7.A26 Workload Management for z/OS Systems (S)
---------+SYS.1.7.A27 Character Set Conversion in z/OS Systems (S)
---------+SYS.1.7.A28 Licence Key Management for z/OS Software (S)
---------+SYS.1.7.A29 Protection of Unix System Services on z/OS Systems (S)
---------+SYS.1.7.A30 Protection of the z/OS Trace Functions (S)
---------+SYS.1.7.A31 Contingency Planning for z/OS Systems (S)
---------+SYS.1.7.A32 Determining Standards for z/OS System Definitions (H)
---------+SYS.1.7.A33 Separation of Test and Production Systems in z/OS (H)
---------+SYS.1.7.A34 Batch Job Planning for z/OS Systems (H)
---------+SYS.1.7.A35 Use of RACF Exits (H)
---------+SYS.1.7.A36 Internal Communication Between Operating Systems (H)
---------+SYS.1.7.A37 Parallel Sysplex in z/OS (H)
---------+SYS.1.7.A38 Use of the VTAM Session Management Exit in z/OS (H)
------+SYS.1.8 Storage Solutions
---------+SYS.1.8.G1. Insecure Default Settings of Storage Components
---------+SYS.1.8.G2. Manipulation of Data via the Storage System
---------+SYS.1.8.G3. Loss of Confidentiality due to Storage-Based Replication Methods
---------+SYS.1.8.G4. Access to Information of Other Clients Using WWN Spoofing
---------+SYS.1.8.G5. Bypassing Logical Network Separation
---------+SYS.1.8.G6. Failure of Storage Solution Components
---------+SYS.1.8.G7. Obtaining Physical Access to SAN Switches
---------+SYS.1.8.A1 Appropriate Installation of Storage Systems [Building Services] (B)
---------+SYS.1.8.A2 Secure Basic Configuration of Storage Solutions (B)
---------+SYS.1.8.A4 Protection of Administration Interfaces (B)
---------+SYS.1.8.A6 Creation of a Security Policy for Storage Solutions (S)
---------+SYS.1.8.A7 Planning of Storage Solutions (S)
---------+SYS.1.8.A8 Selecting an Appropriate Storage Solution (S)
---------+SYS.1.8.A9 Selection of Suppliers for a Storage Solution (S)
---------+SYS.1.8.A10 Drawing Up and Maintaining an Operating Manual (S)
---------+SYS.1.8.A11 Secure Operation of a Storage Solution (S)
---------+SYS.1.8.A13 Monitoring and Administration of Storage Solutions (S)
---------+SYS.1.8.A14 Protection of an SAN Through Segmentation (S)
---------+SYS.1.8.A15 Secure Separation of Clients in Storage Solutions (S)
---------+SYS.1.8.A16 Secure Deletion in SAN Environments (S)
---------+SYS.1.8.A17 Documenting Storage System Settings (S)
---------+SYS.1.8.A18 Security Audits and Reporting Storage Systems (S)
---------+SYS.1.8.A19 Decommissioning Storage Solutions (S)
---------+SYS.1.8.A20 Contingency Planning and Emergency Response for Storage Solutions (S)
---------+SYS.1.8.A21 Use of Storage Pools in Client Separation (H)
---------+SYS.1.8.A22 Use of a High Availability SAN Solution (H)
---------+SYS.1.8.A23 Use of Encryption for Storage Solutions (H)
---------+SYS.1.8.A24 Ensuring the Integrity of the SAN Fabric (H)
---------+SYS.1.8.A25 Multiple Overwrites of LUN Data (H)
---------+SYS.1.8.A26 Securing a SAN with Hard Zoning (H)
------+SYS.2.1 General Client
---------+SYS.2.1.G1. Malware
---------+SYS.2.1.G2. Data Loss Due to Local Data Storage
---------+SYS.2.1.G3. Hardware Defects in Client Systems
---------+SYS.2.1.G4. Unauthorised Use of IT
---------+SYS.2.1.G5. Installation of Unnecessary Operating System Components and Applications
---------+SYS.2.1.G6. Eavesdropping on Rooms Using Microphones and Cameras
---------+SYS.2.1.G7. Incorrect Administration or Use of Devices and Systems
---------+SYS.2.1.A1 Secure User Authorisation (B)
---------+SYS.2.1.A3 Activation of Automatic Update Mechanisms (B)
---------+SYS.2.1.A6 Using Malware Protection Programs (B)
---------+SYS.2.1.A8 Protecting the Boot Process (B)
---------+SYS.2.1.A42 Use of Cloud and Online Functions [User] (B)
---------+SYS.2.1.A9 Defining a Security Policy for Clients (S)
---------+SYS.2.1.A10 Planning the Use of Clients (S)
---------+SYS.2.1.A11 Procurement of Clients (S)
---------+SYS.2.1.A13 Access to Runtime Environments with Unmonitored Code Execution (S)
---------+SYS.2.1.A14 Updates and Patches for Firmware, Operating Systems, and Applications (S)
---------+SYS.2.1.A15 Secure Installation and Configuration of Clients (S)
---------+SYS.2.1.A16 Disabling and Removing Unnecessary Components and IDs (S)
---------+SYS.2.1.A18 Using Encrypted Communication (S)
---------+SYS.2.1.A20 Protecting the Administration Process for Clients (S)
---------+SYS.2.1.A21 Preventing Unauthorised Use of Computer Microphones and Cameras (S)
---------+SYS.2.1.A23 Preferences for Client-Server Services (S)
---------+SYS.2.1.A24 Dealing with External and Removable Media (S)
---------+SYS.2.1.A26 Protection Against Exploitation of Vulnerabilities in Applications (S)
---------+SYS.2.1.A27 Orderly Decommissioning of Clients (S)
---------+SYS.2.1.A34 Encapsulation of Security-Critical Applications and Operating System Components (H)
---------+SYS.2.1.A43 Local Security Policy for Clients (S)
---------+SYS.2.1.A44 Client Security Policy Management (S)
---------+SYS.2.1.A28 Encryption of Clients (H)
---------+SYS.2.1.A29 System and Client Monitoring (S)
---------+SYS.2.1.A30 Setting Up a Reference Environment for Clients (H)
---------+SYS.2.1.A31 Configuring Local Packet Filters (H)
---------+SYS.2.1.A32 Use of Additional Safeguards to Protect Against Exploits (H)
---------+SYS.2.1.A33 Using Execution Control (H)
---------+SYS.2.1.A35 Active Administration of Root Certificates (H)
---------+SYS.2.1.A36 Self-Managed Use of SecureBoot and TPM (H)
---------+SYS.2.1.A37 Use of Multi-Factor Authentication (H)
---------+SYS.2.1.A38 Integration into Contingency Planning (H)
---------+SYS.2.1.A39 Stable and Uninterruptible Power Supply [Building Services] (H)
---------+SYS.2.1.A40 Operational Documentation (H)
---------+SYS.2.1.A41 Use of Quotas for Local Media (H)
---------+SYS.2.1.A45 Extended Logging (H)
------+SYS.2.2.2 Windows 8.1 Clients
---------+SYS.2.2.2.G1. Malware Designed for Windows
---------+SYS.2.2.2.G2. Integrated Cloud Functions
---------+SYS.2.2.2.G3. Impairment of Software Features due to Compatibility Issues
---------+SYS.2.2.2.A1 Selecting a Suitable Windows 8.1 Version (B)
---------+SYS.2.2.2.A2 Defining a Login Procedure for Windows 8.1 (B)
---------+SYS.2.2.2.A3 Use of Virus Protection Programs with Windows 8.1 (B)
---------+SYS.2.2.2.A4 Procurement of Windows 8.1 (S)
---------+SYS.2.2.2.A5 Local Security Policy for Windows 8.1 (S)
---------+SYS.2.2.2.A7 Use of Windows User Account Control (S)
---------+SYS.2.2.2.A8 No Use of the Homegroup Feature [User] (S)
---------+SYS.2.2.2.A9 Data Protection and Data Economy in Windows 8.1 Clients [User] (S)
---------+SYS.2.2.2.A10 Integration of Online Accounts into the Operating System [User] (S)
---------+SYS.2.2.2.A11 Configuration of Synchronisation Mechanisms in Windows 8.1 (S)
---------+SYS.2.2.2.A12 Secure Central Authentication of Windows Networks (S)
---------+SYS.2.2.2.A13 Connection of Windows 8.1 to the Microsoft Store (S)
---------+SYS.2.2.2.A14 Application Control Using Software Restriction Policies and AppLocker (H)
---------+SYS.2.2.2.A15 File System Encryption Using EFS (H)
---------+SYS.2.2.2.A16 Use of Windows PowerShell (H)
---------+SYS.2.2.2.A17 Secure Use of the Maintenance Centre (H)
---------+SYS.2.2.2.A18 Activation of the Last Access Time Stamp (H)
---------+SYS.2.2.2.A19 Use of Login Information Management (H)
---------+SYS.2.2.2.A20 Security During Remote Access Using RDP (H)
---------+SYS.2.2.2.A21 Use of File and Registry Virtualisation (H)
------+SYS.2.2.3 Windows 10 Clients
---------+SYS.2.2.3.G1. Malware in Windows 10
---------+SYS.2.2.3.G2. Integrated Cloud Functions
---------+SYS.2.2.3.G3. Impairment of Software Features Due to Compatibility Issues
---------+SYS.2.2.3.G4. Telemetry Functions of Windows 10
---------+SYS.2.2.3.G5. Restricted Forensics When Using the Virtual Secure Mode (VSM)
---------+SYS.2.2.3.A1 Planning the Use of Cloud Services for Windows 10 (B)
---------+SYS.2.2.3.A2 Selecting and Procuring a Suitable Windows 10 Version (B)
---------+SYS.2.2.3.A4 Telemetry and Privacy Settings in Windows 10 (B)
---------+SYS.2.2.3.A5 Protection Against Malware in Windows 10 (B)
---------+SYS.2.2.3.A6 Integration of Online Accounts into the Operating System [User] (B)
---------+SYS.2.2.3.A9 Secure Central Authentication of Windows Networks (S)
---------+SYS.2.2.3.A12 File and Share Authorisation in Windows 10 (S)
---------+SYS.2.2.3.A13 Using the SmartScreen Function (S)
---------+SYS.2.2.3.A14 Use of the Voice Assistant Cortana [User] (S)
---------+SYS.2.2.3.A15 Use of Synchronisation Mechanisms in Windows 10 (S)
---------+SYS.2.2.3.A16 Connection of Windows 10 to the Microsoft Store (S)
---------+SYS.2.2.3.A17 No Storage of Automatic Login Data (S)
---------+SYS.2.2.3.A18 Use of Windows Remote Support (S)
---------+SYS.2.2.3.A19 Security During Remote Access Using RDP [User] (S)
---------+SYS.2.2.3.A20 Use of User Account Control (UAC) for Privileged Accounts (S)
---------+SYS.2.2.3.A21 Use of the Encrypting File System (H)
---------+SYS.2.2.3.A22 Use of Windows PowerShell (H)
---------+SYS.2.2.3.A23 Advanced Protection of Login Information in Windows 10 (H)
---------+SYS.2.2.3.A24 Activation of the Last Access Time Stamp (H)
---------+SYS.2.2.3.A25 Handling Remote Access Features of Connected User Experience and Telemetry (H)
------+SYS.2.3 Linux and Unix Clients
---------+SYS.2.3.G1. Software from Third-Party Sources
---------+SYS.2.3.G2. Exploitability of the Script Environment
---------+SYS.2.3.G3. Dynamic Loading of Jointly Used Libraries
---------+SYS.2.3.G4. Incorrect Configuration
---------+SYS.2.3.A1 Authentication of Administrators and Users [User] (B)
---------+SYS.2.3.A2 Selection of an Appropriate Distribution (B)
---------+SYS.2.3.A4 Kernel Updates on Unix-Like Systems (B)
---------+SYS.2.3.A5 Secure Installation of Software Packages (B)
---------+SYS.2.3.A6 No Automatic Integration of Removable Drives [User] (S)
---------+SYS.2.3.A7 Restrictive Granting of Access Rights for Files and Directories (S)
---------+SYS.2.3.A8 Use of Techniques to Restrict the Rights of Applications (S)
---------+SYS.2.3.A9 Secure Use of Passwords in the Command Line [User] (S)
---------+SYS.2.3.A11 Preventing the Local Hard Drive From Becoming Overloaded (S)
---------+SYS.2.3.A12 Secure Use of Appliances (S)
---------+SYS.2.3.A14 Protection Against the Use of Unauthorised Peripheral Devices (H)
---------+SYS.2.3.A15 Additional Protection Prior to Executing Undesired Files (H)
---------+SYS.2.3.A17 Additional Prevention of Further Intrusion When Vulnerabilities Are Exploited (H)
---------+SYS.2.3.A18 Additional Kernel Protection (H)
---------+SYS.2.3.A19 Hard Disk or File Encryption (H)
---------+SYS.2.3.A20 Disabling Critical SysRq Features (H)
------+SYS.2.4 macOS Clients
---------+SYS.2.4.G1. Uncontrolled Access to Outsourced Data
---------+SYS.2.4.G2. Misuse of Apple IDs as Central Access Information for Apple Services
---------+SYS.2.4.G3. Attacks on Wireless Interfaces
---------+SYS.2.4.G4. Attacks on Applications with a Preview Function
---------+SYS.2.4.G5. Insecure Protocols in macOS or macOS Applications
---------+SYS.2.4.A1 Planning the Secure Use of macOS (B)
---------+SYS.2.4.A2 Using the Security Functions Integrated into macOS (B)
---------+SYS.2.4.A3 Use of Suitable User Accounts [User] (B)
---------+SYS.2.4.A4 Use of Hard Drive Encryption (S)
---------+SYS.2.4.A5 Disabling Security-Critical Functions in macOS (S)
---------+SYS.2.4.A6 Using Up-To-Date Mac Hardware (S)
---------+SYS.2.4.A7 Two-Factor Authentication for Apple IDs [User] (S)
---------+SYS.2.4.A8 No iCloud Use for Confidential Data [User] (S)
---------+SYS.2.4.A9 Using Additional Protection Programs in macOS (S)
---------+SYS.2.4.A10 Activating the Personal Firewall in macOS (S)
---------+SYS.2.4.A11 Disposing of Macs (S)
---------+SYS.2.4.A12 Firmware Password and Boot Protection on Macs [User] (H)
------+SYS.3.1 Laptops
---------+SYS.3.1.G1. Degradation due to changing operational environments
---------+SYS.3.1.G2. Theft and loss of laptops
---------+SYS.3.1.G3. Unregulated Changes of Laptop Users
---------+SYS.3.1.A1 Rules for Mobile Laptop Use (B)
---------+SYS.3.1.A3 Use of Personal Firewalls (B)
---------+SYS.3.1.A9 Secure Remote Access with Laptops (B)
---------+SYS.3.1.A6 Security Guidelines for Laptops (S)
---------+SYS.3.1.A7 Orderly Issue and Return of Laptops [User] (S)
---------+SYS.3.1.A8 Secure Connection of Laptops to Data Networks [User] (S)
---------+SYS.3.1.A10 Synchronisation of Stored Data on Laptops [User] (S)
---------+SYS.3.1.A11 Securing the Power Supply for Laptops [User] (S)
---------+SYS.3.1.A12 Reporting the Loss of Laptops [User] (S)
---------+SYS.3.1.A13 Encryption of Laptops (S)
---------+SYS.3.1.A14 Suitable Storage of Laptops [User] (S)
---------+SYS.3.1.A15 Appropriate Selection of Laptops [Procurement Department] (S)
---------+SYS.3.1.A16 Central Administration and Administration of Laptops (H)
---------+SYS.3.1.A17 Pooled Storage of Laptops (H)
---------+SYS.3.1.A18 Use of Anti-Theft Devices (H)
------+SYS.3.2.1 General Smartphones and Tablets
---------+SYS.3.2.1.G1. Lack of Operating System Updates
---------+SYS.3.2.1.G2. Software Vulnerabilities in Pre-Installed Apps
---------+SYS.3.2.1.G3. Manipulation of Smartphones and Tablets
---------+SYS.3.2.1.G4. Malware for Smartphones and Tablets
---------+SYS.3.2.1.G5. Web-based Attacks on Mobile Browsers
---------+SYS.3.2.1.G6. Misuse of Health, Fitness, or Location Data
---------+SYS.3.2.1.G7. Misuse of Sensitive Data on the Lock Screen
---------+SYS.3.2.1.G8. Dangers from Private Use of Work-Related Smartphones and Tablets
---------+SYS.3.2.1.G9. Threats Related to Bring-Your-Own-Device (BYOD) Scenarios
---------+SYS.3.2.1.G10. Extended Rights Through Vulnerabilities
---------+SYS.3.2.1.A1 Definition of a Policy for Using Smartphones and Tablets (B)
---------+SYS.3.2.1.A2 Drawing Up a Strategy for Cloud Usage (B)
---------+SYS.3.2.1.A3 Secure Basic Configuration for Mobile Devices (B)
---------+SYS.3.2.1.A4 Use of an Access Control Mechanism [User] (B)
---------+SYS.3.2.1.A5 Operating System and App Updates (B)
---------+SYS.3.2.1.A6 Privacy Settings and Authorisations (B)
---------+SYS.3.2.1.A7 Code of Conduct in the Event of Security Incidents [User] (B)
---------+SYS.3.2.1.A8 Installation of Apps (B)
---------+SYS.3.2.1.A9 Restrictive Use of Functional Extensions (S)
---------+SYS.3.2.1.A10 Policy for Employees Regarding the Use of Mobile Devices [User] (S)
---------+SYS.3.2.1.A11 Storage Encryption (S)
---------+SYS.3.2.1.A12 Use of Non-Personalised Device Names (S)
---------+SYS.3.2.1.A13 Rules Regarding Screen Sharing and Casting (S)
---------+SYS.3.2.1.A16 Disabling Unused Communication Interfaces [User] (S)
---------+SYS.3.2.1.A18 Use of Biometric Authentication (S)
---------+SYS.3.2.1.A19 Use of a Voice Assistant (S)
---------+SYS.3.2.1.A22 Integrating Mobile Devices into Internal Infrastructure via VPN (S)
---------+SYS.3.2.1.A28 Using the Filter Option for Websites (S)
---------+SYS.3.2.1.A31 Regulation of Mobile Payments (S)
---------+SYS.3.2.1.A32 MDM Usage (S)
---------+SYS.3.2.1.A33 Selection and Installation of Security Apps (S)
---------+SYS.3.2.1.A34 Configuration of the DNS Server Used (S)
---------+SYS.3.2.1.A25 Use of Separate Work Environments (H)
---------+SYS.3.2.1.A26 Use of PIM Containers (H)
---------+SYS.3.2.1.A27 Use of Specially Secured End Devices (H)
---------+SYS.3.2.1.A29 Use of an Organisation-Related APN (H)
---------+SYS.3.2.1.A30 Restricted App Installation Using a Whitelist (H)
---------+SYS.3.2.1.A35 Using a Firewall (H)
------+SYS.3.2.2 Mobile Device Management (MDM)
---------+SYS.3.2.2.G1. Insufficient Synchronisation with the MDM System
---------+SYS.3.2.2.G2. Improper MDM Administration
---------+SYS.3.2.2.G3. Inappropriate Rights Management in MDM Systems
---------+SYS.3.2.2.G4. Unauthorised Creation of Movement Profiles Through the MDM System
---------+SYS.3.2.2.A1 Determining a Strategy for Mobile Device Management (B)
---------+SYS.3.2.2.A2 Defining Admissible Mobile Devices (B)
---------+SYS.3.2.2.A3 Selecting an MDM Product (B)
---------+SYS.3.2.2.A4 Distribution of the Basic Configuration to Mobile Devices (B)
---------+SYS.3.2.2.A5 Installing the MDM Client (B)
---------+SYS.3.2.2.A20 Regular Review of the MDM System (B)
---------+SYS.3.2.2.A6 Logging the Device Status (S)
---------+SYS.3.2.2.A7 Installation of Apps (S)
---------+SYS.3.2.2.A12 Protection of the MDM Operating Environment (S)
---------+SYS.3.2.2.A21 Administration of Certificates (S)
---------+SYS.3.2.2.A22 Remote Deletion and Decommissioning of End Devices (S)
---------+SYS.3.2.2.A14 Use of External Reputation Services for Apps (H)
---------+SYS.3.2.2.A17 Monitoring the Use of Mobile Devices (H)
---------+SYS.3.2.2.A19 Using Geofencing (H)
---------+SYS.3.2.2.A23 Enforcing Compliance Requirements (H)
------+SYS.3.2.3 iOS (for Enterprise)
---------+SYS.3.2.3.G1. Concentration of Risk When One User Account (Apple ID) is Used for all Apple services
---------+SYS.3.2.3.G2. Fixed Integration of Pre-Installed Apps and Their Functions
---------+SYS.3.2.3.G3. Improper Access to Outsourced Data
---------+SYS.3.2.3.A1 Strategy for Using iOS Devices (B)
---------+SYS.3.2.3.A2 Planning the Use of Cloud Services (B)
---------+SYS.3.2.3.A7 Preventing Unauthorised Deletion of Configuration Profiles (B)
---------+SYS.3.2.3.A12 Using Apple IDs (S)
---------+SYS.3.2.3.A13 Using the “iOS Restrictions” Configuration Option (S)
---------+SYS.3.2.3.A14 Using the iCloud Infrastructure (S)
---------+SYS.3.2.3.A15 Using Continuity Functions (S)
---------+SYS.3.2.3.A17 Using the Device Code History (S)
---------+SYS.3.2.3.A18 Using the Configuration Option for the Safari Browser (S)
---------+SYS.3.2.3.A21 Installation of Apps and Integration of the Apple App Store (S)
---------+SYS.3.2.3.A23 Using Automatic Deletion of Configuration Profiles (H)
---------+SYS.3.2.3.A25 Using the Configuration Option for AirPrint (H)
---------+SYS.3.2.3.A26 No Connections to Host Systems (H)
------+SYS.3.2.4 Android
---------+SYS.3.2.4.G1. Disabling Security Features
---------+SYS.3.2.4.G2. Malware for the Android Operating System
---------+SYS.3.2.4.G3. Lack of Updates for the Android Operating System
---------+SYS.3.2.4.G4. Risks Posed by User Accounts (Google Accounts) for Google Services
---------+SYS.3.2.4.G5. Pre-Installed apps and Integrated Functions on Android-Based Devices
---------+SYS.3.2.4.A2 Disabling Developer Options (S)
---------+SYS.3.2.4.A3 Using Multi-User and Guest Mode (S)
---------+SYS.3.2.4.A5 Advanced Security Settings (S)
------+SYS.3.3 Mobile Telephones
---------+SYS.3.3.G1. Inadequate Planning for the Purchase of Mobile Phones
---------+SYS.3.3.G2. Loss of a Mobile Phone
---------+SYS.3.3.G3. Carelessness in Handling Mobile Telephony Information
---------+SYS.3.3.G4. Unauthorised Private Use of a Mobile Business Phone
---------+SYS.3.3.G5. Mobile Telephone Failure
---------+SYS.3.3.G6. Analysis of Call Data Relating to the Use of Mobile Phones
---------+SYS.3.3.G7. Eavesdropping on Indoor Conversations over Mobile Phones
---------+SYS.3.3.G8. Use of Obsolete Mobile Phones
---------+SYS.3.3.A1 Security Guidelines and Rules for the Use of Mobile Phones (B)
---------+SYS.3.3.A2 Blocking Lost Mobile Telephones [User] (B)
---------+SYS.3.3.A3 Raising Employee Awareness and Providing Training on the Use of Mobile Telephones (B)
---------+SYS.3.3.A4 Decommissioning and Properly Disposing of Mobile Telephones and the Memory Cards Used in Them (B)
---------+SYS.3.3.A5 Use of the Security Mechanisms of Mobile Telephones [User] (S)
---------+SYS.3.3.A6 Mobile Telephone Updates [User] (S)
---------+SYS.3.3.A7 Acquisition of Mobile Telephones (S)
---------+SYS.3.3.A8 Use of the Wireless Interfaces of Mobile Telephones [User] (S)
---------+SYS.3.3.A10 Secure Data Transmission via Mobile Phones [User] (S)
---------+SYS.3.3.A11 Precautions for Mobile Telephones [User] (S)
---------+SYS.3.3.A12 Setting Up a Mobile Telephone Pool (S)
---------+SYS.3.3.A9 Securing the Power Supply for Mobile Telephones [User] (H)
---------+SYS.3.3.A13 Protection Against Mobile Telephone Data Being Used to Create Movement Profiles [User] (H)
---------+SYS.3.3.A14 Protection Against Call Number Identification During Use of Mobile Telephones [User] (H)
---------+SYS.3.3.A15 Protection Against Eavesdropping on Indoor Conversations Using Mobile Telephones (H)
------+SYS.4.1 Printers, Copiers, and All-in-One Devices
---------+SYS.4.1.G1. Unauthorised Access to Printed Documents
---------+SYS.4.1.G2. Visibility of Metadata
---------+SYS.4.1.G3. Insufficient Protection of Stored Information
---------+SYS.4.1.G4. Unencrypted Communication
---------+SYS.4.1.G5. Unauthorised Sending of Information
---------+SYS.4.1.G6. Uncontrolled Data Exchange via Memory Interfaces on Printers, Copiers, and All-in-One Devices
---------+SYS.4.1.G7. Inadequately Secured Network Access of Printers, Copiers, and All-in-One Devices
---------+SYS.4.1.G8. Poor Access Protection for Device Administration
---------+SYS.4.1.A1 Planning the Use of Printers, Copiers, and All-in-One Devices (B)
---------+SYS.4.1.A2 Suitable Siting and Access to Printers, Copiers, and All-in-One Devices (B)
---------+SYS.4.1.A22 Proper Disposal of Printed Documents (B)
---------+SYS.4.1.A4 Drawing Up a Security Policy for the Use of Printers, Copiers, and All-in-One Devices (S)
---------+SYS.4.1.A5 Drawing Up User Guidelines for Handling Printers, Copiers, and All-in-One Devices [Chief Information Security Officer (CISO)] (S)
---------+SYS.4.1.A7 Restriction of Remote Administrative Access to Printers, Copiers, and All-in-One Devices (S)
---------+SYS.4.1.A11 Restricting the Connection of Printers, Copiers, and All-in-One Devices (S)
---------+SYS.4.1.A15 Encryption of Information for Printers, Copiers, and All-in-One Devices (S)
---------+SYS.4.1.A17 Protection of Payloads and Metadata (S)
---------+SYS.4.1.A18 Configuration of Printers, Copiers, and All-in-One Devices (S)
---------+SYS.4.1.A14 Authentication and Authorisation for Printers, Copiers, and All-in-One Devices (H)
---------+SYS.4.1.A16 Reducing Downtimes for Printers, Copiers, and All-in-One Devices (H)
---------+SYS.4.1.A20 Enhanced Information Protection for Printers, Copiers, and All-in-One Devices (C)
---------+SYS.4.1.A21 Extended Protection of Printers, Copiers, and All-in-One Devices (H)
------+SYS.4.3 Embedded Systems
---------+SYS.4.3.G1. Inadequate Security Requirements for Developing Embedded Systems
---------+SYS.4.3.G2. Unprotected Input/Output Interfaces in Embedded Systems
---------+SYS.4.3.G3. Inadequate Physical Protection of Embedded Systems
---------+SYS.4.3.G4. Hardware Failure and Hardware Errors with Embedded Systems
---------+SYS.4.3.G5. Installation (Flashing) of Manipulated Software Updates on Embedded Systems
---------+SYS.4.3.G6. Side-Channel Attacks on Embedded Crypto Systems
---------+SYS.4.3.G7. Penetration and Manipulation via the Communication Interface of Embedded Systems
---------+SYS.4.3.G8. Use of Forged Components
---------+SYS.4.3.A1 Rules for Handling Embedded Systems (B)
---------+SYS.4.3.A2 Disabling Unused Interfaces and Services of Embedded Systems [Developer] (B)
---------+SYS.4.3.A3 Logging Security-Relevant Events in Embedded Systems (B)
---------+SYS.4.3.A4 Creating Procurement Criteria for Embedded Systems [Procurement Department] (S)
---------+SYS.4.3.A5 Protecting Embedded Systems Against Damaging Environmental Influences [Developer, Planner] (S)
---------+SYS.4.3.A6 Preventing Debugging Options for Embedded Systems [Developer] (S)
---------+SYS.4.3.A7 Hardware Realisation of the Features of Embedded Systems [Developer, Planner, Procurement Department] (S)
---------+SYS.4.3.A8 Using a Secure Operating System for Embedded Systems [Developer, Planner, Procurement Department] (S)
---------+SYS.4.3.A9 Use of Cryptographic Processors or Coprocessors in Embedded Systems [Developer, Planner, Procurement Department] (S)
---------+SYS.4.3.A10 Recovery of Embedded Systems (S)
---------+SYS.4.3.A11 Secure Disposal of Embedded Systems (S)
---------+SYS.4.3.A12 Selection of a Trustworthy Supplier and Logistics Chain and a Qualified Manufacturer for Embedded Systems [Procurement Department] (H)
---------+SYS.4.3.A13 Use of a Certified Operating System [Developer, Planner, Procurement Department] (H)
---------+SYS.4.3.A14 Secured and Authenticated Boot Process for Embedded Systems [Developer, Planner, Procurement Department] (H)
---------+SYS.4.3.A15 Storage Protection in Embedded Systems [Developer, Planner, Procurement Department] (H)
---------+SYS.4.3.A16 Tamper Protection for Embedded Systems [Planner] (H)
---------+SYS.4.3.A17 Automatic Monitoring of Assembly Functions [Planner, Procurement Department] (H)
---------+SYS.4.3.A18 Resistance of Embedded Systems to Side-Channel Attacks [Developer, Procurement Department] (H)
------+SYS.4.4 General IoT Devices
---------+SYS.4.4.G1. Espionage using IoT Devices
---------+SYS.4.4.G2. Use of UPnP
---------+SYS.4.4.G3. Distributed Denial of Service (DDoS)
---------+SYS.4.4.G4. Espionage Attacks Through Backdoors in IoT Devices
---------+SYS.4.4.A1 Criteria for Using IoT Devices (B)
---------+SYS.4.4.A2 Authentication (B)
---------+SYS.4.4.A5 Restriction of Network Access (B)
---------+SYS.4.4.A6 Integration of IoT Devices into Organisation Security Policies (S)
---------+SYS.4.4.A7 Planning the Use of IoT Devices (S)
---------+SYS.4.4.A8 Procurement Criteria for IoT Devices [Procurement Department] (S)
---------+SYS.4.4.A9 Controlling the Use of IoT Devices (S)
---------+SYS.4.4.A10 Secure Installation and Configuration of IoT Devices (S)
---------+SYS.4.4.A11 Using Encrypted Data Transmission (S)
---------+SYS.4.4.A13 Deactivation and Uninstallation of Unnecessary Components (S)
---------+SYS.4.4.A15 Restrictive Granting of Access Rights (S)
---------+SYS.4.4.A16 Elimination of Malware on IoT Devices (S)
---------+SYS.4.4.A17 Monitoring Network Traffic on IoT Devices (S)
---------+SYS.4.4.A18 Logging Security-Relevant Events on IoT Devices (S)
---------+SYS.4.4.A19 Protection of Administration Interfaces (S)
---------+SYS.4.4.A20 Controlled Decommissioning of IoT Devices (S)
---------+SYS.4.4.A21 Operational Environment and Power Supply [Building Services] (H)
---------+SYS.4.4.A22 System Monitoring (H)
---------+SYS.4.4.A23 Auditing of IoT Devices (H)
---------+SYS.4.4.A24 Secure Configuration and Usage of an Embedded Web Server (H)
------+SYS.4.5 Removable Media
---------+SYS.4.5.G1. Carelessness in Handling Information
---------+SYS.4.5.G2. Insufficient Knowledge of Rules and Procedures
---------+SYS.4.5.G3. Theft or Loss of Removable Media
---------+SYS.4.5.G4. Defective Storage Media
---------+SYS.4.5.G5. Degradation due to Changing Operational Environments
---------+SYS.4.5.G6. Spreading of Malware
---------+SYS.4.5.A1 Raising Staff Awareness of Secure Handling of Removable Media (B)
---------+SYS.4.5.A2 Reporting Losses / Tampering [User] (B)
---------+SYS.4.5.A10 Encryption of Storage Media (B)
---------+SYS.4.5.A12 Protection Against Malware [User] (B)
---------+SYS.4.5.A4 Drawing Up a Policy for the Secure Handling of Removable Media (S)
---------+SYS.4.5.A5 Rules on the Transport of Removable Media (S)
---------+SYS.4.5.A6 Storage Media Management [Process Owner] (S)
---------+SYS.4.5.A7 Secure Deletion of Storage Media Before and After Use [Process Owner] (S)
---------+SYS.4.5.A13 Appropriate Labelling of Storage Media for Shipping [User] (S)
---------+SYS.4.5.A11 Protecting Integrity Using Checksums or Digital Signatures (H)
---------+SYS.4.5.A14 Secure Shipping and Packaging (H)
---------+SYS.4.5.A15 Certified Products (H)
---------+SYS.4.5.A16 Use of Dedicated Systems for Data Scanning (H)
---+Industrial IT
------+IND.1 Process Control and Automation Technology
---------+IND.1.G1. Impairment Due to Harmful Environmental Influences
---------+IND.1.G2. Inappropriate Integration of OT into the Security Organisation
---------+IND.1.G3. Inappropriate Integration of OT into Operating Procedures
---------+IND.1.G4. Insufficient Access Protection
---------+IND.1.G5. Insecure Process for Project Planning or Application Development
---------+IND.1.G6. Insecure Administration Concept and Remote Administration
---------+IND.1.G7. Inadequate Monitoring and Detection Procedures
---------+IND.1.G8. Inadequate Test Concept
---------+IND.1.G9. Lack of Lifecycle Concepts
---------+IND.1.G10. Insufficient Security Requirements in Procurement
---------+IND.1.G11. Use of Insecure Protocols
---------+IND.1.G12. Insecure Configuration of ICS Components
---------+IND.1.G13. Dependencies between OT and IT Networks
---------+IND.1.A1 Integration into the Security Organisation (B)
---------+IND.1.A3 Protection Against Malware (B)
---------+IND.1.A18 Logging [OT Operations)] (B)
---------+IND.1.A19 Creating Backups [Employee, OT Operations] (B)
---------+IND.1.A4 Documentation of OT Infrastructure (S)
---------+IND.1.A5 Development of a Suitable Zone Concept [Planner] (S)
---------+IND.1.A6 Change Management in OT Operations (S)
---------+IND.1.A7 Establishing Comprehensive Authorisation Management Across OT and Office IT (S)
---------+IND.1.A8 Secure Administration [IT Operation Department] (S)
---------+IND.1.A9 Restrictive Use of Removable Media and Mobile Devices in ICS Environments (S)
---------+IND.1.A10 Monitoring, Logging, and Detection [OT Operations] (S)
---------+IND.1.A11 Secure Procurement and System Development (S)
---------+IND.1.A12 Establishing Vulnerability Management (S)
---------+IND.1.A20 System Documentation [Employee, OT Operations] (S)
---------+IND.1.A21 Documentation of Communication Relationships [OT Operations (Operational Technology, OT)] (S)
---------+IND.1.A22 Central System Logging and System Monitoring [OT Operations] (S)
---------+IND.1.A23 Disposal of ICS Components [OT Operations] (S)
---------+IND.1.A13 Contingency Planning for OT (H)
---------+IND.1.A14 Strong Authentication for OT Components (H)
---------+IND.1.A15 Monitoring of Wide-Ranging Authorisations (H)
---------+IND.1.A16 Stronger Compartmentalisation of Zones (H)
---------+IND.1.A17 Regular Security Vetting (H)
---------+IND.1.A24 Communication in the Event of Incidents [OT Operations] (S)
------+IND.2.1 General ICS Components
---------+IND.2.1.G1. Insecure System Configuration
---------+IND.2.1.G2. Insufficient User and Authorisation Management
---------+IND.2.1.G3. Insufficient Logging
---------+IND.2.1.G4. Manipulation and Sabotage of an ICS Component
---------+IND.2.1.G5. Use of Insecure Protocols
---------+IND.2.1.G6. Denial-of-Service (DoS) Attacks
---------+IND.2.1.G7. Malware
---------+IND.2.1.G8. Interception of Information/Espionage
---------+IND.2.1.G9. Manipulated Firmware
---------+IND.2.1.A1 Restriction of Access to Configuration and Maintenance Interfaces [OT Operations] (B)
---------+IND.2.1.A2 Using Secure Transmission Protocols for Configuration and Maintenance [Maintenance Personnel, OT Operations] (B)
---------+IND.2.1.A4 Disabling or Uninstalling Unused Services, Functions, and Interfaces [Maintenance Personnel, OT Operations] (B)
---------+IND.2.1.A6 Network Segmentation [OT Operations, Planner] (B)
---------+IND.2.1.A7 Creating Backups [OT Operations] (S)
---------+IND.2.1.A8 Protection Against Malware [OT Operations] (S)
---------+IND.2.1.A11 Maintenance of ICS Components [Employee, OT Operations, Maintenance Personnel] (S)
---------+IND.2.1.A13 Appropriate Commissioning of ICS Components [OT Operations] (S)
---------+IND.2.1.A16 Protecting External Interfaces [OT Operations] (S)
---------+IND.2.1.A17 Use of Secure Protocols for the Transmission of Measurement and Control Data [OT Operations] (S)
---------+IND.2.1.A18 Communication in the Event of Incidents [OT Operations, Employee] (S)
---------+IND.2.1.A19 Security Tests [OT Operations] (H)
---------+IND.2.1.A20 Trustworthy Code [OT Operations] (H)
------+IND.2.2 Programmable Logic Controller (PLC)
---------+IND.2.2.G1. Incomplete Documentation
---------+IND.2.2.A1 Extended System Documentation for Programmable Logic Controllers [OT Operations] (S)
---------+IND.2.2.A3 Time Synchronisation [OT Operations] (S)
------+IND.2.3 Sensors and Actuators
---------+IND.2.3.G1. Insufficient Security Requirements in Procurement
---------+IND.2.3.A1 Installation of Sensors [OT Operations, Maintenance Personnel] (B)
---------+IND.2.3.A2 Calibration of Sensors [Maintenance Personnel] (S)
---------+IND.2.3.A3 Wireless Communication (H)
------+IND.2.4 Machine
---------+IND.2.4.G1. Failure or Disruption due to Insufficient Maintenance
---------+IND.2.4.G2. Targeted manipulations
---------+IND.2.4.A1 Remote Maintenance by Mechanical and System Engineers [OT Operations] (B)
---------+IND.2.4.A2 Operation After End of Warranty [OT Operations] (B)
------+IND.2.7 Safety Instrumented Systems
---------+IND.2.7.G1. Manipulation of the Logic System
---------+IND.2.7.G2. Inadequate Monitoring and Detection Procedures
---------+IND.2.7.A1 Recording and Documentation [Planner, Maintenance Personnel] (B)
---------+IND.2.7.A2 Specified Use of Hardware and Software Components [Maintenance Personnel] (B)
---------+IND.2.7.A3 Changing the Application Program on the Logic System [Maintenance Personnel] (B)
---------+IND.2.7.A4 Making Information Security an Integral Part of Functional Safety Management [ICS Information Security Officer] (S)
---------+IND.2.7.A5 SIS Business Continuity Management [ICS Information Security Officer] (S)
---------+IND.2.7.A6 Secure Planning and Specification of SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---------+IND.2.7.A7 Separation and Independence of the SIS from the Environment [Planner, Maintenance Personnel] (S)
---------+IND.2.7.A8 Secure Transfer of Engineering Data to SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---------+IND.2.7.A9 Protection of Data and Signal Connections [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---------+IND.2.7.A10 Displays and Alerts Pertaining to Simulated or Bridged Variables [Planner] (S)
---------+IND.2.7.A11 Dealing with Integrated Systems [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---------+IND.2.7.A12 Ensuring the Integrity and Authenticity of Application Programs and Configuration Data [Planner] (H)
------+IND.3.2 Remote Maintenance in Industry
---------+IND.3.2.G1. Incomplete Documentation of Remote Maintenance Access in OT
---------+IND.3.2.G2. Insufficient Availability Due to Dependencies on Office and Building IT
---------+IND.3.2.G3. Inadequate Regulations for the Use of OT Remote Maintenance Access
---------+IND.3.2.G4. Insufficient Human Control of OT Remote Maintenance Sessions
---------+IND.3.2.G5. Direct Technical Access to ICS from Insecure Zones
---------+IND.3.2.G6. Insecure Alternative OT Remote Maintenance Access in Case of Disruptions
---------+IND.3.2.G7. Insecure Technical Design of OT Remote Maintenance Access
---------+IND.3.2.G8. Outdated Technical Design of OT Remote Maintenance Access
---------+IND.3.2.A1 Planning the Use of Remote Maintenance in OT (B) [Planner]
---------+IND.3.2.A2 Consistent Documentation of Remote Maintenance by OT and Office and Building IT (B) [IT Operation Department, Maintenance Personnel]
---------+IND.3.2.A3 Regular Checks and Exceptions for Existing OT Remote Maintenance Access (B) [IT Operation Department]
---------+IND.3.2.A4 Binding Regulation of OT Remote Maintenance by Third Parties (B)
---------+IND.3.2.A5 Internal Coordination for OT Remote Maintenance with Office and Building IT (B) [Planner]
---------+IND.3.2.A6 Securing All Remote Maintenance Access to OT (B) [IT Operation Department]
---------+IND.3.2.A7 Technical Decoupling of Access (S) [Planner]
---------+IND.3.2.A8 Explicit Approval of Every OT Remote Maintenance Session (S) [Employee]
---------+IND.3.2.A9 Secure Exchange of Files Involved in OT Remote Maintenance (S) [Planner, IT Operation Department]
---------+IND.3.2.A10 Observation and Control of OT Remote Maintenance Sessions (S) [Employee]
---------+IND.3.2.A11 Central Management of All User Accounts for OT Remote Maintenance (S) [IT Operation Department]
---------+IND.3.2.A12 Dedicated OT Remote Maintenance Solution (H) [Planner]
---------+IND.3.2.A13 Logging of Contents of Remote Maintenance Access in OT (H) [Planner, Data Protection Officer]
---------+IND.3.2.A14 Technical Control of Remote Maintenance Sessions (H) [Planner, Data Protection Officer]
---+Networks and Communication
------+NET.1.1 Network Architecture and Design
---------+NET.1.1.G1. Failure or Insufficient Performance of Communication Links
---------+NET.1.1.G2. Inadequately Secured Network Access
---------+NET.1.1.G3. Inadequate Network Structuring
---------+NET.1.1.A1 Security Policy for the Network [IT Operation Department] (B)
---------+NET.1.1.A2 Documentation of the Network [IT Operation Department] (B)
---------+NET.1.1.A3 Specification of Network Requirements (B)
---------+NET.1.1.A4 Network Separation into Zones (B)
---------+NET.1.1.A5 Client-Server Segmentation (B)
---------+NET.1.1.A6 End Device Segmentation in the Internal Network (B)
---------+NET.1.1.A7 Protection of Sensitive Information (B)
---------+NET.1.1.A8 Basic Protection of Internet Access (B)
---------+NET.1.1.A9 Basic Protection of Communication with Untrusted Networks (B)
---------+NET.1.1.A10 DMZ Segmentation for Access from the Internet (B)
---------+NET.1.1.A11 Protection of Communications Entering the Internal Network from the Internet (B)
---------+NET.1.1.A12 Protection of Outgoing Internal Communication to the Internet (B)
---------+NET.1.1.A13 Network Planning (B)
---------+NET.1.1.A14 Implementation of Network Planning (B)
---------+NET.1.1.A15 Regular Gap Analysis (B)
---------+NET.1.1.A16 Specification of Network Architecture (S)
---------+NET.1.1.A17 Specification of Network Design (S)
---------+NET.1.1.A18 P-A-P Structure for the Internet Connection (S)
---------+NET.1.1.A19 Separation of Infrastructure Services (S)
---------+NET.1.1.A20 Allocation of Dedicated Sub-Networks for IPv4/IPv6 End Device Groups (S)
---------+NET.1.1.A21 Separation of the Management Area (S)
---------+NET.1.1.A22 Specification of the Segmentation Concept (S)
---------+NET.1.1.A23 Separation of Network Segments (S)
---------+NET.1.1.A24 Secure Logical Separation using VLAN (S)
---------+NET.1.1.A25 Detailed and Implementation Planning of Network Architecture and Design (S)
---------+NET.1.1.A26 Specification of Operating Processes for the Network (S)
---------+NET.1.1.A27 Integration of Network Architecture into Contingency Planning [IT Operation Department] (S)
---------+NET.1.1.A28 High-Availability Network and Security Components (H)
---------+NET.1.1.A29 Implementing Network Connections for High Availability (H)
---------+NET.1.1.A30 Protection Against Distributed Denial of Service (H)
---------+NET.1.1.A31 Physical Separation of Network Segments (H)
---------+NET.1.1.A32 Physical Separation of Management Network Segments (H)
---------+NET.1.1.A33 Micro-Segmentation of the Network (H)
---------+NET.1.1.A34 Use of Cryptographic Methods at the Network Level (H)
---------+NET.1.1.A35 Use of Network-Based DLP (H)
---------+NET.1.1.A36 Separation by Means of VLAN for Very High Protection Requirements (H)
------+NET.1.2 Network Management
---------+NET.1.2.G1. Unauthorised Access to Central Network Management Components
---------+NET.1.2.G2. Unauthorised Access to Individual Network Components
---------+NET.1.2.G3. Unauthorised Interference in Network Management Communication
---------+NET.1.2.G4. Insufficient Time Synchronisation of Network Management Components
---------+NET.1.2.A1 Network Management Planning (B)
---------+NET.1.2.A2 Specification of Network Management Requirements (B)
---------+NET.1.2.A6 Regular Backups (B)
---------+NET.1.2.A7 Basic Logging of Events (B)
---------+NET.1.2.A8 Time Synchronisation (B)
---------+NET.1.2.A9 Protection of Network Management Communication and Access to Network Management Tools (B)
---------+NET.1.2.A10 Limitation of SNMP Communication (B)
---------+NET.1.2.A11 Definition of a Security Policy for Network Management (S)
---------+NET.1.2.A12 Current Inventory and Documentation of Network Management (S)
---------+NET.1.2.A13 Drawing Up a Network Management Concept (S)
---------+NET.1.2.A14 Detailed and Implementation Planning (S)
---------+NET.1.2.A15 Concept for Secure Operation of Network Management Infrastructure (S)
---------+NET.1.2.A16 Setup and Configuration of Network Management Solutions (S)
---------+NET.1.2.A17 Regular Gap Analysis within the Framework of Network Management (S)
---------+NET.1.2.A18 Training Measures for Management Solutions [Supervisor] (S)
---------+NET.1.2.A21 Decoupling of Network Management Communication (S)
---------+NET.1.2.A22 Restriction of Management Functions (S)
---------+NET.1.2.A24 Central Configuration Management for Network Components (S)
---------+NET.1.2.A25 Status Monitoring for Network Components (S)
---------+NET.1.2.A26 Alarming and Logging (S)
---------+NET.1.2.A27 Integration of Network Management into Contingency Planning (S)
---------+NET.1.2.A28 Location of Management Clients for In-Band Management (S)
---------+NET.1.2.A29 Using VLANS in the Management Network (S)
---------+NET.1.2.A30 Implementing Management Solutions for High Availability (H)
---------+NET.1.2.A31 Basic Use of Secure Protocols (H)
---------+NET.1.2.A32 Physical Separation of the Management Network [Planner] (H)
---------+NET.1.2.A33 Physical Separation of Management Segments [Planner] (H)
---------+NET.1.2.A35 Specifications for Securing Evidence (H)
---------+NET.1.2.A36 Integration of Network Management Logging into an SIEM Solution (H)
---------+NET.1.2.A37 Time Synchronisation Across Locations (H)
---------+NET.1.2.A38 Specification of Forms of Emergency Operations for Network Management Infrastructure (H)
------+NET.2.1 WLAN Operation
---------+NET.2.1.G1. Failure or Disruption of a Radio Network
---------+NET.2.1.G2. Inadequate Planning of WLAN Usage
---------+NET.2.1.G3. Insufficient Rules on WLAN Usage
---------+NET.2.1.G4. Inappropriate Selection of Authentication Methods
---------+NET.2.1.G5. Incorrect Configuration of WLAN Infrastructure
---------+NET.2.1.G6. Insufficient WLAN Security Mechanisms
---------+NET.2.1.G7. Eavesdropping on WLAN Communication
---------+NET.2.1.G8. Simulating a Valid Access Point (Rogue access Points)
---------+NET.2.1.G9. Unprotected LAN Access at Access Points
---------+NET.2.1.G10. Hardware Damage
---------+NET.2.1.G11. Theft of an Access Point
---------+NET.2.1.A1 Definition of a Strategy for WLAN Usage (B)
---------+NET.2.1.A2 Selection of a Suitable WLAN Standard [Planner] (B)
---------+NET.2.1.A3 Selection of Suitable Crypto Methods for WLAN [Planner] (B)
---------+NET.2.1.A4 Suitable Location of Access Points [Building Services] (B)
---------+NET.2.1.A5 Secure Basic Configuration of Access Points (B)
---------+NET.2.1.A6 Secure Configuration of WLAN Infrastructure (B)
---------+NET.2.1.A7 Setting Up a Distribution System [Planner] (B)
---------+NET.2.1.A8 Codes of Conduct in the Event of WLAN Security Incidents (B)
---------+NET.2.1.A9 Secure Connection of WLANs to a LAN [Planner] (S)
---------+NET.2.1.A10 Drawing Up a Security Policy for WLAN Operation (S)
---------+NET.2.1.A11 Selection of Suitable WLAN Components (S)
---------+NET.2.1.A12 Use of a Suitable WLAN Management Solution (S)
---------+NET.2.1.A13 Regular Security Checks of WLANs (S)
---------+NET.2.1.A14 Regular Audits of WLAN Components (S)
---------+NET.2.1.A15 Using a VPN to Secure WLANs (H)
---------+NET.2.1.A16 Additional Protection When Connecting WLANs to a LAN (H)
---------+NET.2.1.A17 Protecting Communication Between Access Points (H)
---------+NET.2.1.A18 Use of Wireless Intrusion Detection / Wireless Intrusion Prevention Systems (H)
------+NET.2.2 WLAN Usage
---------+NET.2.2.G1. Insufficient Knowledge of Rules and Procedures
---------+NET.2.2.G2. Non-Compliance with Security Safeguards
---------+NET.2.2.G3. Eavesdropping on WLAN Communication
---------+NET.2.2.G4. Analysis of Connection Data Related to Wireless Communication
---------+NET.2.2.G5. Simulating a Valid Access Point (Rogue Access Points)
---------+NET.2.2.A1 Creating a User Policy for WLAN [IT Operation Department] (B)
---------+NET.2.2.A2 Awareness and Training of WLAN Users [Supervisor, IT Operation Department] (B)
---------+NET.2.2.A3 Safeguarding WLAN Usage in Hotspots [IT Operation Department] (B)
---------+NET.2.2.A4 Codes of Conduct in the Event of WLAN Security Incidents (S)
------+NET.3.1 Routers and Switches
---------+NET.3.1.G1. Distributed Denial of Service (DDoS)
---------+NET.3.1.G2. Manipulation
---------+NET.3.1.G3. Incorrect Configuration of a Router or Switch
---------+NET.3.1.G4. Improper Planning and Design
---------+NET.3.1.G5. Incompatible Active Network Components
---------+NET.3.1.G6. MAC Flooding
---------+NET.3.1.G7. Spanning Tree Attacks
---------+NET.3.1.G8. GARP Attacks
---------+NET.3.1.A1 Secure Basic Configuration of a Router or Switch (B)
---------+NET.3.1.A4 Protection of Administration Interfaces (B)
---------+NET.3.1.A5 Protection Against Fragmentation Attacks (B)
---------+NET.3.1.A6 Emergency Access to Routers and Switches (B)
---------+NET.3.1.A7 Logging on Routers and Switches (B)
---------+NET.3.1.A8 Regular Backups (B)
---------+NET.3.1.A9 Operational Documentation (B)
---------+NET.3.1.A10 Creating a Security Policy(S)
---------+NET.3.1.A11 Procurement of a Router or Switch (S)
---------+NET.3.1.A12 Drawing Up a Configuration Checklist for Routers and Switches (S)
---------+NET.3.1.A13 Administration Using a Separate Management Network (S)
---------+NET.3.1.A14 Protection Against Misuse of ICMP Messages (S)
---------+NET.3.1.A15 Bogon and Spoofing Filtering (S)
---------+NET.3.1.A16 Protection Against “IPv6 Routing Header Type-0” attacks (S)
---------+NET.3.1.A17 Protection Against DoS and DDoS Attacks (S)
---------+NET.3.1.A18 Configuration of Access Control Lists (S)
---------+NET.3.1.A19 Protection of Switch Ports (S)
---------+NET.3.1.A20 Security Aspects of Routing Protocols (S)
---------+NET.3.1.A21 Identity and Authorisation Management in Network Infrastructure (S)
---------+NET.3.1.A22 Contingency Planning for Routers and Switches (S)
---------+NET.3.1.A23 Audits and Penetration Tests (S)
---------+NET.3.1.A24 Use of Network Access Controls (H)
---------+NET.3.1.A25 Advanced Integrity Protection for Configuration Files (H)
---------+NET.3.1.A26 High Availability (H)
---------+NET.3.1.A27 Bandwidth Management for Critical Applications and Services (H)
---------+NET.3.1.A28 Use of Certified Products (H)
------+NET.3.2 Firewall
---------+NET.3.2.G1. Distributed denial of service (DDoS)
---------+NET.3.2.G2. Manipulation
---------+NET.3.2.G3. Bypassing firewall rules
---------+NET.3.2.G4. Incorrect configuration and errors in operating a firewall
---------+NET.3.2.A1 Creating a Security Policy (B)
---------+NET.3.2.A2 Definition of Firewall Rules (B)
---------+NET.3.2.A3 Configuring Appropriate Filter Rules on the Packet Filter (B)
---------+NET.3.2.A4 Secure Firewall Configuration (B)
---------+NET.3.2.A6 Protection of Administration Interfaces (B)
---------+NET.3.2.A7 Emergency Access to the Firewall (B)
---------+NET.3.2.A8 Prevention of Dynamic Routing (B)
---------+NET.3.2.A9 Logging (B)
---------+NET.3.2.A10 Protection Against Fragmentation Attacks on the Packet Filter (B)
---------+NET.3.2.A14 Operational Documentation (B)
---------+NET.3.2.A15 Procuring a Firewall (B)
---------+NET.3.2.A16 Creation of a “P-A-P” structure (S)
---------+NET.3.2.A17 Disabling IPv4 or IPv6 (S)
---------+NET.3.2.A18 Administration Using a Separate Management Network (S)
---------+NET.3.2.A19 Protection Against TCP SYN Flooding, UDP Packet Storms, and Sequence Number Guessing on the Packet Filter (S)
---------+NET.3.2.A20 Protection of Fundamental Internet Protocols (S)
---------+NET.3.2.A21 Temporary Decryption of Data Traffic (S)
---------+NET.3.2.A22 Secure Time Synchronisation (S)
---------+NET.3.2.A23 System Monitoring and Evaluation (S)
---------+NET.3.2.A24 Audits and Penetration Tests (S)
---------+NET.3.2.A32 Firewall Contingency Planning (S)
---------+NET.3.2.A25 Advanced Integrity Protection for Configuration Files (H)
---------+NET.3.2.A26 Outsourcing of Functional Extensions to Dedicated Hardware (H)
---------+NET.3.2.A27 Use of Different Firewall Operating Systems and Products in Multi-Layer Firewall Architecture (H)
---------+NET.3.2.A28 Central Filtering of Active Content (H)
---------+NET.3.2.A29 Use of High-Availability Solutions (H)
---------+NET.3.2.A30 Bandwidth Management for Critical Applications and Services (H)
---------+NET.3.2.A31 Use of Certified Products (H)
------+NET.3.3 VPN
---------+NET.3.3.G1. Inadequate Planning of VPN Usage
---------+NET.3.3.G2. Insecure VPN Service Providers
---------+NET.3.3.G3. Insecure Configuration of VPN Clients for Remote Access
---------+NET.3.3.G4. Insecure Default Settings on VPN Components
---------+NET.3.3.A1 Planning the Use of VPNs (B)
---------+NET.3.3.A2 Selection of an Appropriate VPN Service Provider (B)
---------+NET.3.3.A3 Secure Installation of VPN End Devices (B)
---------+NET.3.3.A4 Secure Configuration of a VPN (B)
---------+NET.3.3.A5 Blocking Unneeded VPN Accounts (B)
---------+NET.3.3.A6 Analysis of VPN Requirements (S)
---------+NET.3.3.A7 Planning the Technical VPN Implementation (S)
---------+NET.3.3.A8 Drawing Up a Security Policy for VPN Usage (S)
---------+NET.3.3.A9 Selection of Suitable VPN Products (S)
---------+NET.3.3.A10 Secure Operation of a VPN (S)
---------+NET.3.3.A11 Secure Integration of an External Network (S)
---------+NET.3.3.A12 User and Access Management for Remote Access VPNs (S)
---------+NET.3.3.A13 Integration of VPN Components into a Firewall (S)
------+NET.4.1 Telecommunications Systems
---------+NET.4.1.G1. Eavesdropping on Telecommunications Systems
---------+NET.4.1.G2. Eavesdropping on Rooms using Telecommunications Systems
---------+NET.4.1.G3. Call Charge Fraud
---------+NET.4.1.G4. Abuse of Freely Accessible Telephone Extensions
---------+NET.4.1.A1 Requirements Analysis and Planning for Telecommunications Systems [IT Operation Department] (B)
---------+NET.4.1.A2 Selection of Telecommunications Service Providers [IT Operation Department] (B)
---------+NET.4.1.A5 Logging for Telecommunications Systems (B)
---------+NET.4.1.A6 Creating a Security Policy for Telecommunications Systems [IT Operation Department] (S)
---------+NET.4.1.A7 Suitable Installation of the Telecommunications System (S)
---------+NET.4.1.A8 Limitation and Blocking of Unnecessary or Security-Critical Features (S)
---------+NET.4.1.A9 Training on the Secure Use of Telecommunications Systems [Supervisor] (S)
---------+NET.4.1.A10 Documentation and Revision of the Telecommunications System Configuration [IT Operation Department] (S)
---------+NET.4.1.A11 Decommissioning Telecommunications Systems and Devices [IT Operation Department] (S)
---------+NET.4.1.A12 Backup of Configuration Files (S)
---------+NET.4.1.A13 Acquisition of Telecommunications Systems (S)
---------+NET.4.1.A14 Contingency Planning for Telecommunication Systems (S)
---------+NET.4.1.A15 Emergency Calls in the Event of a Telecommunications System Failure (S)
---------+NET.4.1.A16 Securing End Devices in Openly Accessible Rooms (S)
---------+NET.4.1.A17 Maintenance of Telecommunications Systems (S)
---------+NET.4.1.A18 Increased Access Protection (H)
---------+NET.4.1.A19 Redundant Connections (H)
------+NET.4.2 VoIP
---------+NET.4.2.G1. Incorrect Configuration of VoIP Middleware
---------+NET.4.2.G2. Incorrect Configuration of VoIP Components
---------+NET.4.2.G3. Eavesdropping on Telephone Calls
---------+NET.4.2.G4. Abuse of Freely Accessible Telephone Extensions
---------+NET.4.2.A1 Planning the Use of VoIP (B)
---------+NET.4.2.A3 Secure Administration and Configuration of VoIP End Devices (B)
---------+NET.4.2.A4 Restricting Accessibility via VoIP (B)
---------+NET.4.2.A5 Secure Configuration of VoIP Middleware (B)
---------+NET.4.2.A7 Drawing up a Security Policy for VoIP (S)
---------+NET.4.2.A8 Encryption of VoIP (S)
---------+NET.4.2.A9 Selection of Suitable VoIP Components (S)
---------+NET.4.2.A11 Secure Handling of VoIP End Devices [User] (S)
---------+NET.4.2.A12 Secure Decommissioning of VoIP Components (S)
---------+NET.4.2.A13 Firewall Requirements When Using VoIP (S)
---------+NET.4.2.A14 Encryption of Signalling (H)
---------+NET.4.2.A15 Secure Media Transport Using SRTP (H)
---------+NET.4.2.A16 Network Separation for Data and VoIP (H)
------+NET.4.3 Fax Machines and Fax Servers
---------+NET.4.3.G1. Inadequate or Incorrect Supply of Consumables
---------+NET.4.3.G2. Fax Transmission Errors
---------+NET.4.3.G3. Manipulation of Address Books and Distribution Lists
---------+NET.4.3.G4. Unauthorised Reading of Incoming Fax Transmissions
---------+NET.4.3.G5. Evaluation of Residual Information in Fax Machines
---------+NET.4.3.G6. Impersonation of a False Sender on Fax Machines
---------+NET.4.3.A1 Suitable Siting of a Fax Machine [Building Services] (B)
---------+NET.4.3.A2 Information for Employees on Using Fax Machines (B)
---------+NET.4.3.A3 Secure Operation of a Fax Server [IT Operation Department] (B)
---------+NET.4.3.A4 Drawing Up a Security Policy for Fax Use (S)
---------+NET.4.3.A6 Procurement of Suitable Fax Machines and Servers [Procurement Department] (S)
---------+NET.4.3.A7 Suitable Labelling of Outgoing Fax Transmissions [User] (S)
---------+NET.4.3.A8 Appropriate Disposal of Consumable Fax Accessories and Spare Parts (S)
---------+NET.4.3.A9 Using Transmission and Reception Logs (S)
---------+NET.4.3.A10 Control of Programmable Destination Addresses, Logs, and Distribution Lists (S)
---------+NET.4.3.A11 Preventing Fax Machine Overload [IT Operation Department] (H)
---------+NET.4.3.A12 Blocking Specific Recipient and Sender Fax Numbers (H)
---------+NET.4.3.A13 Designating Authorised Fax Operators [User] (H)
---------+NET.4.3.A14 Producing Copies of Incoming Fax Messages [User] (H)
---------+NET.4.3.A15 Announcing and Acknowledging Fax Messages [User] (H)
---+Infrastructure
------+INF.1 Generic Building
---------+INF.1.G1. Fire
---------+INF.1.G2. Lightning
---------+INF.1.G3. Water
---------+INF.1.G4. Natural Hazards and Disasters
---------+INF.1.G5. Threats in the Vicinity
---------+INF.1.G6. Unauthorised Site Access
---------+INF.1.G7. Violation of Laws or Regulations
---------+INF.1.G8. Insufficient Fire Protection
---------+INF.1.G9. Failure of the Power Supply
---------+INF.1.A1 Planning the Building Protection [Planner] (B)
---------+INF.1.A2 Appropriate Segmentation of Circuits (B)
---------+INF.1.A3 Compliance with Fire Prevention Regulations (B)
---------+INF.1.A4 Fire Detection in Buildings [Planner] (B)
---------+INF.1.A5 Hand-Held Fire Extinguishers (B)
---------+INF.1.A6 Closed Windows and Doors [Employee] (B)
---------+INF.1.A7 Site Access Regulations and Control [Central Administration] (B)
---------+INF.1.A8 Smoking Ban (B)
---------+INF.1.A10 Compliance with Relevant Standards and Regulations [Construction Company, Construction Manager] (B)
---------+INF.1.A9 Security Concept for Building Use [Planner] (S)
---------+INF.1.A12 Key Management (S)
---------+INF.1.A13 Regulations Governing Access to Distributors (S)
---------+INF.1.A14 Lightning Protection Devices (S)
---------+INF.1.A15 Plans Detailing the Location of Supply Lines (S)
---------+INF.1.A16 Avoiding References to the Locations of Sensitive Building Areas (S)
---------+INF.1.A17 Structural Smoke Protection [Planner] (S)
---------+INF.1.A18 On-Site Fire Safety Inspections (S)
---------+INF.1.A19 Notification of the Fire Safety Officer (S)
---------+INF.1.A20 Alert Plan and Fire Drills (S)
---------+INF.1.A27 Burglary Protection (S)
---------+INF.1.A36 Regular Documentation Updates (S)
---------+INF.1.A22 Secure Doors and Windows (H)
---------+INF.1.A23 Formation of Security Zones [Planner] (H)
---------+INF.1.A24 Automatic Drainage (H)
---------+INF.1.A25 Selection of Appropriate Locations [Top Management] (A)
---------+INF.1.A26 Gatekeeper or Security Service (H)
---------+INF.1.A30 Selection of an Appropriate Building (H)
---------+INF.1.A31 Moving Out of Buildings [Central Administration] (H)
---------+INF.1.A32 Firestop Seal Register (H)
---------+INF.1.A34 Intruder and Fire Detection System (H)
---------+INF.1.A35 Perimeter Protection [Planner, Building Services] (H)
------+INF.2 Data Centre and Server Room
---------+INF.2.G1. Incorrect Planning
---------+INF.2.G2. Insufficient Site Access Controls
---------+INF.2.G3. Insufficient Monitoring
---------+INF.2.G4. Insufficient Air Conditioning in a Data Centre
---------+INF.2.G5. Fire
---------+INF.2.G6. Water
---------+INF.2.G7. Insufficient Burglary Protection
---------+INF.2.G8. Failure of the Power Supply
---------+INF.2.G9. Contamination
---------+INF.2.A1 Defining Requirements [Building Services, Planner] (B)
---------+INF.2.A2 Formation of Fire Zones [Planner] (B)
---------+INF.2.A3 Use of an Uninterruptible Power Supply [Building Services] (B)
---------+INF.2.A4 Emergency Shutdown of the Power Supply [Building Services] (B)
---------+INF.2.A5 Maintenance of Air Temperature and Humidity [Building Services] (B)
---------+INF.2.A6 Site Access Control [Building Services] (B)
---------+INF.2.A7 Locking and Securing Facilities [Employee, Building Services] (B)
---------+INF.2.A8 Use of a Fire Alarm System [Planner] (B)
---------+INF.2.A9 Use of an Extinguishing or Fire Prevention System [Building Services] (B)
---------+INF.2.A10 Inspection and Maintenance of Infrastructure [Maintenance Personnel, Building Services] (B)
---------+INF.2.A11 Automatic Monitoring of Infrastructure [Building Services] (B)
---------+INF.2.A17 Use of Early Fire Detection [Planner, Building Services] (B)
---------+INF.2.A29 Avoidance and Monitoring of Unnecessary Wiring [Building Services, Planner] (B)
---------+INF.2.A12 Data Centre Perimeter Protection [Planner, Building Services] (S)
---------+INF.2.A13 Planning and Installation of Alarm Systems [Building Services] (S)
---------+INF.2.A14 Use of an Emergency Power System [Planner, Building Services] (S)
---------+INF.2.A15 Overvoltage Protection Devices [Planner, Building Services] (S)
---------+INF.2.A16 Air Conditioning in Data Centres [Planner] (S)
---------+INF.2.A19 Functional Testing of Technical Infrastructure [Building Services] (S)
---------+INF.2.A30 Systems for Extinguishing or Preventing Fires [Building Services, Planner] (S)
---------+INF.2.A21 Alternate Data Centre (H)
---------+INF.2.A22 Implementation of Dust-Protection Measures [Building Services] (H)
---------+INF.2.A23 Appropriate Design of Data Centre Cabling [Building Services] (H)
---------+INF.2.A24 Use of Video Monitoring Systems [Data Protection Officer, Building Services, Planner] (H)
---------+INF.2.A25 Redundant Design of Uninterruptible Power Supplies [Planner] (H)
---------+INF.2.A26 Redundant Design of Emergency Power Systems [Planner] (H)
---------+INF.2.A28 Use of Higher-Level Alarm Systems [Planner] (H)
------+INF.5 Room or Cabinet for Technical Infrastructure
---------+INF.5.G1. Incorrect Planning
---------+INF.5.G2. Unauthorised Site Access
---------+INF.5.G3. Inadequate Ventilation
---------+INF.5.G4. Fire
---------+INF.5.G5. Water
---------+INF.5.G6. Failure of the Power Supply
---------+INF.5.G7. Lightning and Overvoltages
---------+INF.5.G8. Electromagnetic Interference Fields
---------+INF.5.G9. Electrostatic Discharge
---------+INF.5.A1 Planning the Room Protection [Planner] (B)
---------+INF.5.A2 Location and Size of the Technical Infrastructure Room [Planner] (B)
---------+INF.5.A3 Site Access Regulations and Control [Building Services, IT Operation Department] (B)
---------+INF.5.A4 Protection Against Intrusion [Planner, Building Services] (B)
---------+INF.5.A5 Avoidance of and Protection Against Electromagnetic Interference Fields [Planner] (B)
---------+INF.5.A6 Minimising Fire Loads [Employee, Planner] (B)
---------+INF.5.A7 Prevention of Incorrect Use [Employee, Planner] (B)
---------+INF.5.A9 Power Supply [Building Services] (B)
---------+INF.5.A8 Avoidance of Uncontrolled Electrostatic Discharge [Planner] (S)
---------+INF.5.A10 Maintenance of Air Temperature and Humidity [Building Services] (S)
---------+INF.5.A11 Avoidance of Pipes with Hazardous Liquids and Gases [Planner, Building Services] (S)
---------+INF.5.A12 Protection Against Accidental Damage to Supply Lines [Planner] (S)
---------+INF.5.A13 Protection Against Fire and Smoke Damage [Planner, Building Services] (S)
---------+INF.5.A14 Minimising Fire Hazards from Neighbouring Areas [Planner, Building Services] (S)
---------+INF.5.A15 Lightning and Overvoltage Protection [Planner, Building Services] (S)
---------+INF.5.A16 Use of an Uninterruptible Power Supply [Building Services] (S)
---------+INF.5.A17 Inspection and Maintenance of Infrastructure [Building Services, IT Operation Department, Maintenance Personnel] (S)
---------+INF.5.A18 Location of the Technical Infrastructure Room [Planner] (B)
---------+INF.5.A19 Redundancy of the Technical Infrastructure Room [Planner] (H)
---------+INF.5.A20 Enhanced Protection Against Intrusion and Sabotage [Planner] (H)
---------+INF.5.A22 Redundant Power Supply Design [Planner] (H)
---------+INF.5.A23 Emergency Power Systems [Planner, Building Services, Maintenance Personnel] (H)
---------+INF.5.A24 Ventilation and Cooling [Planner, Building Services, Maintenance Personnel] (H)
---------+INF.5.A25 Increased Protection Against Fire and Smoke Damage [Planner] (H)
---------+INF.5.A26 Monitoring of the Power Supply [Planner, Building Services] (H)
------+INF.6 Storage Media Archives
---------+INF.6.G1. Excessive Temperature and Humidity
---------+INF.6.G2. Insufficient Rules
---------+INF.6.G3. Unauthorised Entry to Sensitive Rooms
---------+INF.6.G4. Theft
---------+INF.6.A1 Hand-Held Fire Extinguishers [Fire Safety Officer] (B)
---------+INF.6.A2 Site Access Regulations and Control [Building Services] (B)
---------+INF.6.A3 Protection Against Dust and Other Contamination (B)
---------+INF.6.A4 Closed Windows and Locked Doors [Employee] (B)
---------+INF.6.A5 Using Protective Cabinets [Employee] (S)
---------+INF.6.A6 Avoidance of Water Pipes [Building Services] (S)
---------+INF.6.A7 Compliance with Climatic Requirements [Building Services] (S)
---------+INF.6.A8 Secure Doors and Windows [Planner] (S)
---------+INF.6.A9 Alarm System [Building Services] (H)
------+INF.7 Office Workplace
---------+INF.7.G1. Unauthorised Site Access
---------+INF.7.G2. Impairment due to Unfavourable Working Conditions
---------+INF.7.G3. Manipulations by Cleaning Staff, Third-Party Personnel, or Visitors
---------+INF.7.G4. Manipulation or Destruction of IT, Accessories, Information, or Software in an Office Room
---------+INF.7.G5. Theft
---------+INF.7.G6. Exposed Cables
---------+INF.7.A1 Suitable Selection and Use of an Office Room [Supervisor] (B)
---------+INF.7.A2 Closed Windows and Locked Doors [Employee, Building Services] (b)
---------+INF.7.A3 Exposed Cables (S)
---------+INF.7.A5 Workplace Ergonomics [Central Administration, Supervisor] (S)
---------+INF.7.A6 Workplace Cleanliness [Employee, Supervisor] (S)
---------+INF.7.A7 Suitable Storage of Official Documents and Storage Media [Employee, Building Services] (S)
---------+INF.7.A8 Use of Anti-Theft Devices [Employee] (H)
------+INF.8 Working from Home
---------+INF.8.G1. Insufficient Rules for Home Workplaces
---------+INF.8.G2. Unauthorised Access to Sensitive Rooms of a Home Workplace
---------+INF.8.G3. Impaired Use of IT due to Adverse Working Conditions at a Home Workplace
---------+INF.8.G4. Insecure Transport of Files and Storage Media
---------+INF.8.G5. Inadequate Disposal of Storage Media and Documents
---------+INF.8.G6. Manipulation or Destruction of IT, Accessories, Information, or Software at a Home Workplace
---------+INF.8.G7. Higher Risk of Theft at Home Workplaces
---------+INF.8.A1 Securing Official Documents at the Home Workplace (B)
---------+INF.8.A2 Transporting Working Material to the Home Workplace (B)
---------+INF.8.A3 Protection Against Unauthorised Access to the Home Workplace (B)
---------+INF.8.A4 Suitable Configuration of the Home Workplace (S)
---------+INF.8.A5 Disposal of Confidential Information at the Home Workplace (S)
---------+INF.8.A6 Handling Official Documents with Increased Protection Needs at the Home Workplace (H)
------+INF.9 Mobile Workplace
---------+INF.9.G1. Insufficient Rules for Mobile Workplaces
---------+INF.9.G2. Degradation due to Changing Operational Environments
---------+INF.9.G3. Manipulation or Destruction of IT Systems, Accessories, Information, or Software at a Mobile Workplace
---------+INF.9.G4. Delays Caused by Temporarily Restricted Availability
---------+INF.9.G5. Insecure Transport of Files and Storage Media
---------+INF.9.G6. Inadequate Disposal of Storage Media and Documents
---------+INF.9.G7. Loss of Confidentiality of Sensitive Information
---------+INF.9.G8. Theft or Loss of Storage Media or Documents
---------+INF.9.A1 Appropriate Selection and Usage of a Mobile Workplace [IT Operation Department] (B)
---------+INF.9.A2 Regulations for Mobile Workplaces [Human Resources Department] (B)
---------+INF.9.A3 Site and Data Access Protection [Central Administration, Employee] (B)
---------+INF.9.A4 Working with External IT Systems [IT Operation Department, Employee] (B)
---------+INF.9.A5 Prompt Reporting of a Loss [Employee] (S)
---------+INF.9.A6 Disposal of Confidential Information [Employee] (S)
---------+INF.9.A7 Legal Framework Conditions for Mobile Working [Human Resources Department] (S)
---------+INF.9.A8 Security Policy for Mobile Workplaces [IT Operation Department] (S)
---------+INF.9.A9 Encryption of Portable IT Systems and Storage Media [IT Operation Department] (S)
---------+INF.9.A12 Using a Screen Protector [Employee] (S)
---------+INF.9.A10 Use of Anti-Theft Devices [Employee] (H)
---------+INF.9.A11 Prohibiting Use of Insecure Environments [IT Operation Department] (H)
------+INF.10 Meeting, Event, and Training Rooms
---------+INF.10.G1. Insufficient Rules
---------+INF.10.G2. Incompatibility between External and In-House IT Systems
---------+INF.10.G3. Threats Caused by Visitors
---------+INF.10.G4. Exposed Cables
---------+INF.10.G5. Theft
---------+INF.10.G6. Loss of Confidentiality of Sensitive Information
---------+INF.10.A1 Secure Use of Meeting, Event, and Training Rooms [Building Services, IT Operation Department] (B)
---------+INF.10.A3 Closed Windows and Doors [Employee] (B)
---------+INF.10.A4 Planning Meeting, Event, and Training Rooms (S)
---------+INF.10.A5 Exposed Cables (S)
---------+INF.10.A6 Configuring Secure Network Access [IT Operation Department] (S)
---------+INF.10.A7 Secure Configuration of Training and Presentation Computers [IT Operation Department] (S)
---------+INF.10.A8 Creating a Proof of Use for Rooms (S)
---------+INF.10.A9 Resetting Training and Presentation Computers [IT Operation Department] (H)
---------+INF.10.A10 Ban on Carrying Mobile Phones (H)
------+INF.11 General Vehicle
---------+INF.11.G1. Insufficient Rules for Vehicles
---------+INF.11.G2. Carelessness and Lack of Security Awareness in Handling Vehicles
---------+INF.11.G3. Unregulated Data Transmission to Third Parties and Insecure Communication Interfaces
---------+INF.11.G4. Improper Vehicle Modifications
---------+INF.11.G5. Manipulation, Unauthorised Access, and Theft Involving Vehicles
---------+INF.11.G6. Dangers in Connection with Maintenance, Repairs, and Updates
---------+INF.11.G7. Threats During Decommissioning
---------+INF.11.G8. Unacceptable Temperature and Humidity in Vehicles
---------+INF.11.A1 Planning and Procurement [Process Owner, Procurement Department, Data Protection Officer] (B)
---------+INF.11.A2 Maintenance, Inspection, and Updates [Process Owner, IT Operation Department] (B)
---------+INF.11.A3 Regulations for the Use of Vehicles [IT Operation Department, Process Owner, User, Data Protection Officer] (B)
---------+INF.11.A4 Creating a Security Policy [Process Owner, IT Operation Department] (S)
---------+INF.11.A5 Drawing Up a Security Concept (S)
---------+INF.11.A6 Establishing Instructions [Process Owner, User] (S)
---------+INF.11.A7 Proper Handling of Vehicles and Sensitive Information [Process Owner, User] (S)
---------+INF.11.A8 Protection against Weather-Related Influences [User, Process Owner] (S)
---------+INF.11.A9 Ensuring Fuel Supplies [Process Owner] (S)
---------+INF.11.A10 Disposal [IT Operation Department, Process Owner] (S)
---------+INF.11.A11 Replacement Arrangements in the Event of Breakdowns [Process Owner] (H)
---------+INF.11.A12 Anti-Theft System or Security Guards [Process Owner, Employee] (H)
---------+INF.11.A13 Damaging Third-Party Interference [Process Owner] (H)
---------+INF.11.A14 Protection of Sensitive Information from Unauthorised Access and Disclosure [IT Operation Department, Process Owner] (H)
---------+INF.11.A15 Physical Protection of Interfaces [IT Operation Department, Process Owner] (H)
---------+INF.11.A16 Fire Extinguishing System [Process Owner] (H)
---------+INF.11.A17 Network Separation of the In-Vehicle Network with a Special Vehicle Network via Gateways (H)
------+INF.12 Cabling
---------+INF.12.G1. Cable Fires
---------+INF.12.G2. Inadequate Dimensioning of Cabling
---------+INF.12.G3. Insufficient Documentation on Cabling
---------+INF.12.G4. Inadequately Protected Distributors
---------+INF.12.G5. Cable Damage
---------+INF.12.G6. Voltage Fluctuations, Overvoltage, and Undervoltage
---------+INF.12.G7. Use of Low-Quality Power Strips
---------+INF.12.G8. Unauthorised Cable Connections
---------+INF.12.G9. Impairment of Lines
---------+INF.12.G10. Eavesdropping and Manipulation of Cables
---------+INF.12.A1 Selection of Appropriate Cable Types [IT Operation Department, Building Services] (B)
---------+INF.12.A2 Planning Cable Routing [IT Operation Department, Building Services] (B)
---------+INF.12.A3 Proper Installation [IT Operation Department, Building Services] (B)
---------+INF.12.A4 EMC-Compliant Power Supply [Building Services] (B)
---------+INF.12.A5 Requirements Analysis for Cabling [IT Operation Department, Building Services] (S)
---------+INF.12.A6 Cabling Approval [IT Operation Department, Building Services] (S)
---------+INF.12.A7 Overvoltage Protection [Building Services] (S)
---------+INF.12.A8 Removing and Disabling Cables No Longer Required [IT Operation Department, Building Services] (S)
---------+INF.12.A9 Fire Prevention in Trays [Building Services] (S)
---------+INF.12.A10 Documentation and Labelling of Cabling [IT Operation Department, Building Services] (S)
---------+INF.12.A11 Neutral Documentation in Distributors [IT Operation Department, Building Services] (S)
---------+INF.12.A12 Inspection of Electrical Installations and Existing Connections [IT Operation Department, Building Services] (S)
---------+INF.12.A13 Avoidance of Electrical Ignition Sources [Building Services] (S)
---------+INF.12.A14 A-B Supply [Building Services] (B)
---------+INF.12.A15 Material Protection of Cabling [IT Operation Department, Building Services] (H)
---------+INF.12.A16 Use of Cabinet Systems [Building Services] (H)
---------+INF.12.A17 Redundancies for IT Cabling [IT Operation Department] (H)
------+INF.13 Technical Building Management (TBM)
---------+INF.13.G1. Lack of a Basis for Planning TBM
---------+INF.13.G2. Lack of Documentation in TBM
---------+INF.13.G3. Compromised Interfaces with TBM
---------+INF.13.G4. Inadequate Monitoring of Building Services
---------+INF.13.G5. Insufficient Role and Authorisation Management
---------+INF.13.A1 Assessment of the Current Situation When Taking Over Existing Buildings (B)
---------+INF.13.A2 Regulation and Documentation of Responsibilities and Authorities in the Building [Top Management, Planner] (B)
---------+INF.13.A3 Documentation of Building Facilities (B)
---------+INF.13.A4 Creation of a Security Policy for TBM (S)
---------+INF.13.A5 Planning TBM (S) [Planer]
---------+INF.13.A6 Drawing Up a TBM Concept (S) [Planner]
---------+INF.13.A7 Creating a Radio Frequency Register (S)
---------+INF.13.A8 Creation and Maintenance of an Inventory for TBM (S) [Planner]
---------+INF.13.A9 Regulation of the Use of Computer-Aided Facility Management (S) [Planner]
---------+INF.13.A10 Regulation of the Use of Building Information Modelling (S) [Planner]
---------+INF.13.A11 Adequate Hardening of Systems in TBM (S)
---------+INF.13.A12 Secure Configuration of TBM Systems (S)
---------+INF.13.A13 Secure Connection of Restricted Trusted Systems in TBM (S) [Planner]
---------+INF.13.A14 Consideration of Special Roles and Authorisations in TBM (S)
---------+INF.13.A15 Protection Against Malware in TBM (S)
---------+INF.13.A16 Process for Changes in TBM (S)
---------+INF.13.A17 Provisions for Maintenance and Repairs in TBM (S)
---------+INF.13.A18 Proactive Maintenance in TBM (S) [Planner]
---------+INF.13.A19 Conceptualisation and Implementation of Monitoring in TBM (S) [Planner]
---------+INF.13.A20 Provisions for Event Management in TBM (S) [Planner]
---------+INF.13.A21 Logging in TBM (S)
---------+INF.13.A22 Performing System Tests in TBM (S) [Planner]
---------+INF.13.A23 Integration of TBM into Vulnerability Management (S)
---------+INF.13.A24 Ensuring Control of Cloud-Based Processes for TBM (S) [Planner]
---------+INF.13.A25 Establishment of a Test Environment for TBM (H) [Planner]
---------+INF.13.A26 Securing BIM (H) [Planner]
---------+INF.13.A27 Establishment of a Private Cloud for TBM (H) [Planner]
---------+INF.13.A28 Secure Use of Artificial intelligence in TBM (H)
---------+INF.13.A29 Integration of TBM into SIEM (H) [IT Operation Department]
---------+INF.13.A30 Performing Penetration Tests in TBM (H)
------+INF.14 Building Automation and Control Systems (BACS)
---------+INF.14.G1. Inadequate Planning of BACS
---------+INF.14.G2. Incorrect Integration of Building Services Systems into BACS
---------+INF.14.G3. Use of Insecure Systems and Protocols in BACS
---------+INF.14.G4. Poor Configuration of BACS
---------+INF.14.G5. Manipulation of Interfaces of Stand-Alone Building Services Systems to BACS
---------+INF.14.G6. Inadequately Protected Access to BACS
---------+INF.14.G7. Inadequately Secured BACS Control Elements
---------+INF.14.G8. Inadequately Secured Mobile Communication Connections
---------+INF.14.A1 Planning BACS (B) [Planner]
---------+INF.14.A2 Defining Commissioning and Interface Management for BACS (B)
---------+INF.14.A3 Secure Connection of Building Services and Building Services Systems (B)
---------+INF.14.A4 Consideration of Hazard Detection Systems in BACS (B) [Planner]
---------+INF.14.A5 Documentation of BACS (B)
---------+INF.14.A6 Separation of BACS Networks (B) [Planner, IT Operation Department]
---------+INF.14.A7 Drawing Up a Security Policy for BACS (S)
---------+INF.14.A8 Requirements Specification for BACS (S)
---------+INF.14.A9 Developing a BACS Concept (S)
---------+INF.14.A10 Formation of Independent BACS Areas (S) [Planner]
---------+INF.14.A11 Securing Freely Accessible Ports and Access Points in BACS (S) [Planner]
---------+INF.14.A12 Use of Secure Transmission Protocols for BACS (S)
---------+INF.14.A13 Network Segmentation in BACS (S) [Planner]
---------+INF.14.A14 Use of BACS-Appropriate Access Protection (S)
---------+INF.14.A15 Security of BACS-Specific Networks (S)
---------+INF.14.A16 Securing Wireless Communication in BACS Networks (S) [Planner]
---------+INF.14.A17 Securing Mobile Communications in BACS Networks (S) [Planner]
---------+INF.14.A18 Secure Integration of BACS-External Systems (S)
---------+INF.14.A19 Use of Dedicated Address Ranges for BACS Networks (S) [Planner]
---------+INF.14.A20 Avoiding Broadcast Communication in BACS Networks (S) [Planner]
---------+INF.14.A21 Displaying Validity of Information in BACS (S)
---------+INF.14.A22 Ensuring Autonomous Functioning of BACS and Building Services Systems (S) [Planner]
---------+INF.14.A23 Use of Physically Robust Components for BACS (S) [Planner]
---------+INF.14.A24 Time Synchronisation for BACS (S)
---------+INF.14.A25 Dedicated Monitoring in BACS (S)
---------+INF.14.A26 Logging in BACS (S)
---------+INF.14.A27 Consideration of Interactions Between BACS Components in Contingency Planning (S)
---------+INF.14.A28 Physical Separation of BACS (H) [Planner]
---------+INF.14.A29 Separation of Individual Building Services Systems (H)
---------+INF.14.A30 Provision of a Dedicated BACS Time Server for Time Synchronisation (H)
|
IT-Grundschutz-Compendium
Final Draft, 1 February 2022
1. Przegląd
| Tytuł |
Norma |
|
Security Management
|
The ISMS layer includes the Security Management module as a basis for all further activities in the security process.
|
|
Organisation and Personnel
|
The ORP layer addresses organisational and personnel security aspects. This layer includes, for example, the modules Organisation and Personnel.
|
|
Concepts and Procedures
|
The CON layer includes modules that deal with concepts and methodologies. Typical modules of the CON layer include Crypto Concept and Data Protection.
|
|
Operations
|
The OPS layer comprises all security aspects of an operational nature. This particularly includes the security aspects of IT operations in both in-house environments and those that are run partially or completely by third parties. Furthermore, it includes the security aspects that are to be considered when running IT operations for third parties. Examples of modules in the OPS layer include Protection Against Malware and Outsourcing for Customers.
|
|
Detection and Response
|
The DER layer contains all the modules which are relevant for reviewing the implemented security safeguards, detecting security incidents and taking suitable action in response. Typical components of the DER layer are Security Incident Handling and Provisions for IT Forensics.
|
|
Applications
|
The APP layer deals with the protection of applications and services in communications, directory services, network-based services and business and client applications, amongst other areas. Typical modules within the APP layer include General E-Mail Clients and Servers, Office Products, Web Servers and Relational Database Systems.
|
|
IT Systems
|
The SYS layer addresses the individual IT systems of a given information domain that may have been combined into groups. The security aspects of servers, desktop systems, mobile devices and other IT systems such as printers and telecommunication systems are addressed here. The SYS layer includes, for example, modules for specific operating systems, as well as General Smartphones and Tablets and Printers, Copiers, and All-in-One Devices.
|
|
Industrial IT
|
The IND layer deals with the security aspects of industrial IT. This layer includes modules such as Process Control and Automation Technology, General ICS Components and Programmable Logic Controller (PLC).
|
|
Networks and Communication
|
The NET layer examines the networking aspects not primarily related to specific IT systems, but to network connections and communication. It includes, for example, the modules Network Management, Firewall and WLAN Operation.
|
|
Infrastructure
|
The INF layer brings together different aspects of infrastructural security by addressing architectural and technical factors. It includes the modules Generic Building and Data Centre and Server Room.
|
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
Powiązane zgłoszenia
|