New version: C5:2026 Cloud Computing Compliance Criteria Catalogue (1.0.1-ab906417ae) – 1 new, 858 changed, 1 removed, 1 assignments

• Document: C5:2026 Cloud Computing Compliance Criteria Catalogue (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/CloudComputing/ComplianceControlsCatalogue/2026/C5_machine_readable.zip?__blob=publicationFile&v=4)
• Version: 1.0.1-ab906417ae
• Project: BSI
• Import: #2413, 24.10.2026 10:17, bsi

The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).

Taken over directly (additional fields, HTML of an unchanged text): 17 issues.

Review: 0 open, 861 applied, 0 rejected.

New sections (1)

• AM-01.02AC [applied]
  C5:2026-AM-01.02AC

Changed sections (858)

• Cloud Computing Compliance Criteria Catalogue (C5:2026) – title, text (before: C5:2026) [applied]
  C5:2026
• GC-01 Information on applicable law, jurisdiction, countries, partitions, regions, zones and locations – title, text (before: GC-01 Angaben zu anwendbarem Recht, Gerichtsbarkeit, Länder, Partitionen, Regionen, Zonen und Stan…) [applied]
  C5:2026-GC-GC-01
• GC-02 Information on availability and incident handling during regular operation – title, text (before: GC-02 Angaben zu Verfügbarkeit und Störungsbeseitigung im Regelbetrieb) [applied]
  C5:2026-GC-GC-02
• GC-03 Information on recovery parameters in emergency operation – title, text (before: GC-03 Angaben zu Wiederanlaufparametern im Notbetrieb) [applied]
  C5:2026-GC-GC-03
• GC-04 Information on the approach to ensuring service availability – title, text (before: GC-04 Angaben zum Ansatz zur Sicherstellung der Dienstverfügbarkeit) [applied]
  C5:2026-GC-GC-04
• GC-05 Information on how investigation requests from government agencies are handled – title, text (before: GC-05 Angaben zum Umgang mit Untersuchungsanfragen von staatlichen Stellen) [applied]
  C5:2026-GC-GC-05
• GC-06 Information on certifications or attestations – title, text (before: GC-06 Angaben zu Zertifizierungen oder Bescheinigungen) [applied]
  C5:2026-GC-GC-06
• OIS-01 Information Security Management System (ISMS) – title (before: OIS-01 Informationssicherheitsmanagementsystem (ISMS)) [applied]
  C5:2026-OIS-01
• OIS-01.01B – text [applied]
  C5:2026-OIS-01.01B
• OIS-01.02B – text [applied]
  C5:2026-OIS-01.02B
• OIS-01.03B – text [applied]
  C5:2026-OIS-01.03B
• OIS-01.01AC – text [applied]
  C5:2026-OIS-01.01AC
• OIS-01.01AS – text [applied]
  C5:2026-OIS-01.01AS
• OIS-02 Information Security Policy – title (before: OIS-02 Informationssicherheitsrichtlinie) [applied]
  C5:2026-OIS-02
• OIS-02.01B – text [applied]
  C5:2026-OIS-02.01B
• OIS-02.02B – text [applied]
  C5:2026-OIS-02.02B
• OIS-02.03B – text [applied]
  C5:2026-OIS-02.03B
• OIS-03 Interfaces and Dependencies – title (before: OIS-03 Schnittstellen und Abhängigkeiten) [applied]
  C5:2026-OIS-03
• OIS-03.01B – text [applied]
  C5:2026-OIS-03.01B
• OIS-03.02B – text [applied]
  C5:2026-OIS-03.02B
• OIS-03.03B – text [applied]
  C5:2026-OIS-03.03B
• OIS-03.04B – text [applied]
  C5:2026-OIS-03.04B
• OIS-03.05B – text [applied]
  C5:2026-OIS-03.05B
• OIS-03 Supplementary Information - Complementary Customer Criteria – text [applied]
  C5:2026-OIS-03.SI
• OIS-04 Segregation of Duties – title (before: OIS-04 Aufgabentrennung) [applied]
  C5:2026-OIS-04
• OIS-04.01B – text [applied]
  C5:2026-OIS-04.01B
• OIS-04.02B – text [applied]
  C5:2026-OIS-04.02B
• OIS-04.03B – text [applied]
  C5:2026-OIS-04.03B
• OIS-04.04B – text [applied]
  C5:2026-OIS-04.04B
• OIS-04.01AC – text [applied]
  C5:2026-OIS-04.01AC
• OIS-04.02AC – text [applied]
  C5:2026-OIS-04.02AC
• OIS-05.01B – text [applied]
  C5:2026-OIS-05.01B
• OIS-05.02B – text [applied]
  C5:2026-OIS-05.02B
• OIS-05.03B – text [applied]
  C5:2026-OIS-05.03B
• OIS-06 Contact with Relevant Government Agencies and Interest Groups – title (before: OIS-06 Kontakt zu relevanten Behörden und Interessengruppen) [applied]
  C5:2026-OIS-06
• OIS-06.01B – text [applied]
  C5:2026-OIS-06.01B
• OIS-07 Risk Management Policy – title (before: OIS-07 Richtlinie für Risikomanagement) [applied]
  C5:2026-OIS-07
• OIS-07.01B – text [applied]
  C5:2026-OIS-07.01B
• OIS-08 Application of the Risk Management Policy - Risk Assessment – title (before: OIS-08 Anwendung der Richtlinie für Risikomanagement - Risikobeurteilung) [applied]
  C5:2026-OIS-08
• OIS-08.01B – text [applied]
  C5:2026-OIS-08.01B
• OIS-08.02B – text [applied]
  C5:2026-OIS-08.02B
• OIS-08.03B – text [applied]
  C5:2026-OIS-08.03B
• OIS-08.04B – text [applied]
  C5:2026-OIS-08.04B
• OIS-08.05B – text [applied]
  C5:2026-OIS-08.05B
• OIS-08.06B – text [applied]
  C5:2026-OIS-08.06B
• OIS-08.01AC – text [applied]
  C5:2026-OIS-08.01AC
• OIS-08.02AC – text [applied]
  C5:2026-OIS-08.02AC
• OIS-08.01AS – text [applied]
  C5:2026-OIS-08.01AS
• OIS-09 Application of the Risk Management Policy - Risk Treatment – title (before: OIS-09 Anwendung der Richtlinie für Risikomanagement - Risikobehandlung) [applied]
  C5:2026-OIS-09
• OIS-09.01B – text [applied]
  C5:2026-OIS-09.01B
• OIS-09.02B – text [applied]
  C5:2026-OIS-09.02B
• OIS-09.03B – text [applied]
  C5:2026-OIS-09.03B
• OIS-09.04B – text [applied]
  C5:2026-OIS-09.04B
• OIS-09.05B – text [applied]
  C5:2026-OIS-09.05B
• OIS-09.06B – text [applied]
  C5:2026-OIS-09.06B
• OIS-09.07B – text [applied]
  C5:2026-OIS-09.07B
• OIS-10 Information Security in Project Management – title (before: OIS-10 Informationssicherheit im Projektmanagement) [applied]
  C5:2026-OIS-10
• OIS-10.01B – text [applied]
  C5:2026-OIS-10.01B
• Security Policies and Procedures (SP) – text [applied]
  C5:2026-SP
• SP-01 Documentation, Communication and Provision of Policies and Procedures – title (before: SP-01 Dokumentation, Kommunikation und Bereitstellung von Richtlinien und Verfahren) [applied]
  C5:2026-SP-01
• SP-01.01B – text [applied]
  C5:2026-SP-01.01B
• SP-01.02B – text [applied]
  C5:2026-SP-01.02B
• SP-01.03B – text [applied]
  C5:2026-SP-01.03B
• SP-01.04B – text [applied]
  C5:2026-SP-01.04B
• SP-02 Review and Approval of Policies and Procedures – title (before: SP-02 Ãœberprüfung und Freigabe von Richtlinien und Verfahren) [applied]
  C5:2026-SP-02
• SP-02.01B – text [applied]
  C5:2026-SP-02.01B
• SP-02.02B – text [applied]
  C5:2026-SP-02.02B
• SP-03 Exceptions from Existing Policies and Procedures – title (before: SP-03 Ausnahmen von bestehenden Richtlinien und Verfahren) [applied]
  C5:2026-SP-03
• SP-03.01B – text [applied]
  C5:2026-SP-03.01B
• SP-03.02B – text [applied]
  C5:2026-SP-03.02B
• SP-03.03B – text [applied]
  C5:2026-SP-03.03B
• SP-03.04B – text [applied]
  C5:2026-SP-03.04B
• SP-03.05B – text [applied]
  C5:2026-SP-03.05B
• SP-03.01AC – text [applied]
  C5:2026-SP-03.01AC
• SP-03.02AC – text [applied]
  C5:2026-SP-03.02AC
• SP-03.03AC – text [applied]
  C5:2026-SP-03.03AC
• SP-03 Supplementary Information - Complementary Customer Criteria – text [applied]
  C5:2026-SP-03.SI
• HR-01 Verification of Qualification and Trustworthiness – title (before: HR-01 Ãœberprüfung der Qualifikation und Vertrauenswürdigkeit) [applied]
  C5:2026-HR-01
• HR-01.01B – text [applied]
  C5:2026-HR-01.01B
• HR-01.02B – text [applied]
  C5:2026-HR-01.02B
• HR-01.03B – text [applied]
  C5:2026-HR-01.03B
• HR-01.04B – text [applied]
  C5:2026-HR-01.04B
• HR-01.05B – text [applied]
  C5:2026-HR-01.05B
• HR-01.06B – text [applied]
  C5:2026-HR-01.06B
• HR-01.01AC – text [applied]
  C5:2026-HR-01.01AC
• HR-02 Employment Terms and Conditions – title (before: HR-02 Beschäftigungs- und Vertragsbedingungen) [applied]
  C5:2026-HR-02
• HR-02.01B – text [applied]
  C5:2026-HR-02.01B
• HR-02.02B – text [applied]
  C5:2026-HR-02.02B
• HR-02.03B – text [applied]
  C5:2026-HR-02.03B
• HR-02.04B – text [applied]
  C5:2026-HR-02.04B
• HR-02.05B – text [applied]
  C5:2026-HR-02.05B
• HR-03 Security Training and Awareness Programme – title (before: HR-03 Programm zur Sicherheitsausbildung und Sensibilisierung) [applied]
  C5:2026-HR-03
• HR-03.01B – text [applied]
  C5:2026-HR-03.01B
• HR-03.02B – text [applied]
  C5:2026-HR-03.02B
• HR-03.03B – text [applied]
  C5:2026-HR-03.03B
• HR-03.04B – text [applied]
  C5:2026-HR-03.04B
• HR-03.01AC – text [applied]
  C5:2026-HR-03.01AC
• HR-03.02AC – text [applied]
  C5:2026-HR-03.02AC
• HR-03.03AC – text [applied]
  C5:2026-HR-03.03AC
• HR-03.04AC – text [applied]
  C5:2026-HR-03.04AC
• HR-03.05AC – text [applied]
  C5:2026-HR-03.05AC
• HR-03.02AS – text [applied]
  C5:2026-HR-03.02AS
• HR-04 Disciplinary Measures – title (before: HR-04 Maßregelungsprozess) [applied]
  C5:2026-HR-04
• HR-04.01B – text [applied]
  C5:2026-HR-04.01B
• HR-04.02B – text [applied]
  C5:2026-HR-04.02B
• HR-04.03B – text [applied]
  C5:2026-HR-04.03B
• HR-04.04B – text [applied]
  C5:2026-HR-04.04B
• HR-05 Responsibilities in the Event of Termination or Change of Employment – title (before: HR-05 Verantwortlichkeiten bei Beendigung oder Änderung der Beschäftigung) [applied]
  C5:2026-HR-05
• HR-05.01B – text [applied]
  C5:2026-HR-05.01B
• HR-06 Non-disclosure Agreements – title (before: HR-06 Vertraulichkeitsvereinbarungen) [applied]
  C5:2026-HR-06
• HR-06.01B – text [applied]
  C5:2026-HR-06.01B
• HR-06.02B – text [applied]
  C5:2026-HR-06.02B
• HR-06.03B – text [applied]
  C5:2026-HR-06.03B
• HR-06.04B – text [applied]
  C5:2026-HR-06.04B
• HR-06.05B – text [applied]
  C5:2026-HR-06.05B
• HR-06.06B – text [applied]
  C5:2026-HR-06.06B
• HR-07 Remote Working - Policy – title (before: HR-07 Remote-Arbeit - Richtlinie) [applied]
  C5:2026-HR-07
• HR-07.01B – text [applied]
  C5:2026-HR-07.01B
• HR-08 Remote Working - Implementation – title (before: HR-08 Remote-Arbeit - Umsetzung) [applied]
  C5:2026-HR-08
• HR-08.01B – text [applied]
  C5:2026-HR-08.01B
• AM-01 Asset Management Framework – title (before: AM-01 Rahmenwerk für Asset Management) [applied]
  C5:2026-AM-01
• AM-01.01B – text [applied]
  C5:2026-AM-01.01B
• AM-01.01AC – text [applied]
  C5:2026-AM-01.01AC
• AM-02 Asset Inventory – title (before: AM-02 Asset-Inventar) [applied]
  C5:2026-AM-02
• AM-02.01B – text [applied]
  C5:2026-AM-02.01B
• AM-02.02B – text [applied]
  C5:2026-AM-02.02B
• AM-02.03B – text [applied]
  C5:2026-AM-02.03B
• AM-02.04B – text [applied]
  C5:2026-AM-02.04B
• AM-02.05B – text [applied]
  C5:2026-AM-02.05B
• AM-03 Hardware Asset Inventory – title (before: AM-03 Hardware-Asset-Inventar) [applied]
  C5:2026-AM-03
• AM-03.01B – text [applied]
  C5:2026-AM-03.01B
• AM-04 Software Asset Inventory – title (before: AM-04 Software-Asset-Inventar) [applied]
  C5:2026-AM-04
• AM-04.01B – text [applied]
  C5:2026-AM-04.01B
• AM-04.01AC – text [applied]
  C5:2026-AM-04.01AC
• AM-05 Policy for the Proper and Secure Use of Assets – title (before: AM-05 Richtlinie für die ordnungsgemäße und sichere Nutzung von Assets) [applied]
  C5:2026-AM-05
• AM-05.01B – text [applied]
  C5:2026-AM-05.01B
• AM-05.02B – text [applied]
  C5:2026-AM-05.02B
• AM-06 Commissioning of Hardware – title (before: AM-06 Inbetriebnahme von Hardware) [applied]
  C5:2026-AM-06
• AM-06.01B – text [applied]
  C5:2026-AM-06.01B
• AM-06.02B – text [applied]
  C5:2026-AM-06.02B
• AM-07 Decommissioning of Hardware – title (before: AM-07 Außerbetriebnahme von Hardware) [applied]
  C5:2026-AM-07
• AM-07.01B – text [applied]
  C5:2026-AM-07.01B
• AM-07.02B – text [applied]
  C5:2026-AM-07.02B
• AM-07.01AC – text [applied]
  C5:2026-AM-07.01AC
• AM-07.01AS – text [applied]
  C5:2026-AM-07.01AS
• AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets – title (before: AM-08 Verpflichtung zur ordnungsgemäßen Nutzung, sicheren Handhabung und Rückgabe von Assets) [applied]
  C5:2026-AM-08
• AM-08.01B – text [applied]
  C5:2026-AM-08.01B
• AM-08.02B – text [applied]
  C5:2026-AM-08.02B
• AM-08.03B – text [applied]
  C5:2026-AM-08.03B
• AM-09 Asset Classification and Labelling – title (before: AM-09 Klassifizierung und Kennzeichnung von Assets) [applied]
  C5:2026-AM-09
• AM-09.01B – text [applied]
  C5:2026-AM-09.01B
• AM-09.02B – text [applied]
  C5:2026-AM-09.02B
• AM-09.03B – text [applied]
  C5:2026-AM-09.03B
• AM-09.04B – text [applied]
  C5:2026-AM-09.04B
• AM-09.01AC – text [applied]
  C5:2026-AM-09.01AC
• AM-09.02AC – text [applied]
  C5:2026-AM-09.02AC
• AM-09.03AC – text [applied]
  C5:2026-AM-09.03AC
• AM-09.04AC – text [applied]
  C5:2026-AM-09.04AC
• AM-09 Supplementary Information - Complementary Customer Criteria – text [applied]
  C5:2026-AM-09.SI
• AM-10 Protection of Hardware on Hold – title (before: AM-10 Schutz von vorübergehend nicht genutzter Hardware) [applied]
  C5:2026-AM-10
• AM-10.01B – text [applied]
  C5:2026-AM-10.01B
• AM-10.01AS – text [applied]
  C5:2026-AM-10.01AS
• AM-11 Transfer of Hardware – title (before: AM-11 Transfer von Hardware) [applied]
  C5:2026-AM-11
• AM-11.01B – text [applied]
  C5:2026-AM-11.01B
• AM-11.02B – text [applied]
  C5:2026-AM-11.02B
• AM-11.03B – text [applied]
  C5:2026-AM-11.03B
• AM-12 Removable Media and Endpoint Devices – title (before: AM-12 Wechselmedien und Endgeräte) [applied]
  C5:2026-AM-12
• AM-12.01B – text [applied]
  C5:2026-AM-12.01B
• AM-12.01AC – text [applied]
  C5:2026-AM-12.01AC
• Physical Security (PS) – text [applied]
  C5:2026-PS
• PS-01 Physical Security and Environmental Control Requirements – title (before: PS-01 Sicherheitsanforderungen für Gebäude und Räumlichkeiten) [applied]
  C5:2026-PS-01
• PS-01.01B – text [applied]
  C5:2026-PS-01.01B
• PS-01.02B – text [applied]
  C5:2026-PS-01.02B
• PS-01.03B – text [applied]
  C5:2026-PS-01.03B
• PS-01.04B – text [applied]
  C5:2026-PS-01.04B
• PS-01.05B – text [applied]
  C5:2026-PS-01.05B
• PS-01.06B – text [applied]
  C5:2026-PS-01.06B
• PS-01.01AC – text [applied]
  C5:2026-PS-01.01AC
• PS-01.02AC – text [applied]
  C5:2026-PS-01.02AC
• PS-01.03AC – text [applied]
  C5:2026-PS-01.03AC
• PS-01.04AC – text [applied]
  C5:2026-PS-01.04AC
• PS-01.05AC – text [applied]
  C5:2026-PS-01.05AC
• PS-02 Redundancy Model – title (before: PS-02 Redundanzmodell) [applied]
  C5:2026-PS-02
• PS-02.01B – text [applied]
  C5:2026-PS-02.01B
• PS-02.02B – text [applied]
  C5:2026-PS-02.02B
• PS-02.03B – text [applied]
  C5:2026-PS-02.03B
• PS-02.01AS – text [applied]
  C5:2026-PS-02.01AS
• PS-02.02AS – text [applied]
  C5:2026-PS-02.02AS
• PS-02 Supplementary Information - Complementary Customer Criteria – text [applied]
  C5:2026-PS-02.SI
• PS-03 Perimeter Protection – title (before: PS-03 Perimeterschutz) [applied]
  C5:2026-PS-03
• PS-03.01B – text [applied]
  C5:2026-PS-03.01B
• PS-03.02B – text [applied]
  C5:2026-PS-03.02B
• PS-03.03B – text [applied]
  C5:2026-PS-03.03B
• PS-03.04B – text [applied]
  C5:2026-PS-03.04B
• PS-03.05B – text [applied]
  C5:2026-PS-03.05B
• PS-03.06B – text [applied]
  C5:2026-PS-03.06B
• PS-03.01AC – text [applied]
  C5:2026-PS-03.01AC
• PS-04 Physical Site Access Control – title (before: PS-04 Physische Zutrittskontrolle) [applied]
  C5:2026-PS-04
• PS-04.01B – text [applied]
  C5:2026-PS-04.01B
• PS-04.02B – text [applied]
  C5:2026-PS-04.02B
• … and 658 more

Sections no longer in the document (only marked, not deleted) (1)

• AM-02.01AC [applied]
  C5:2026-AM-02.01AC

Labels (1)

• Applicable: Germany [applied]

New version: C3A Criteria enabling Cloud Computing Autonomy (v1.0-d985b4e7a9) – 0 new, 45 changed, 0 removed, 2 assignments

• Document: C3A Criteria enabling Cloud Computing Autonomy (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/CloudComputing/C3A_Cloud_Computing_Autonomy.pdf?__blob=publicationFile&v=10)
• Version: v1.0-d985b4e7a9
• Project: BSI
• Import: #2414, 24.10.2026 10:17, bsi

The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).

Taken over directly (additional fields, HTML of an unchanged text): 73 issues.

Review: 0 open, 47 applied, 0 rejected.

Changed sections (45)

• Criteria enabling Cloud Computing Autonomy (C3A) – title, text (before: C3A) [applied]
  BSI-C3A
• 1 Introduction – text [applied]
  BSI-C3A-1
• 1.2 EU Cloud Sovereignty Framework and BSI C5:2026 as the C3A foundation – text [applied]
  BSI-C3A-1.2
• 1.3 Structure – text [applied]
  BSI-C3A-1.3
• 1.4 Terms of Use – text [applied]
  BSI-C3A-1.4
• 1.5 Definitions – text [applied]
  BSI-C3A-1.5
• 2 Criteria, Additional Criteria and Supplementary Information – text [applied]
  BSI-C3A-2
• SOV-1 Strategic Sovereignty – text [applied]
  BSI-C3A-SOV-1
• SOV-1-01 Jurisdiction – text [applied]
  BSI-C3A-SOV-1-01
• SOV-1-02 Registered Office – text [applied]
  BSI-C3A-SOV-1-02
• SOV-1-03 CSP Effective Control – text [applied]
  BSI-C3A-SOV-1-03
• SOV-1-04 CSP Control Change – text [applied]
  BSI-C3A-SOV-1-04
• SOV-2 Legal & Jurisdictional Sovereignty – text [applied]
  BSI-C3A-SOV-2
• SOV-2-01 Extraterritorial Exposure – text [applied]
  BSI-C3A-SOV-2-01
• SOV-2-02 Audit Rights – text [applied]
  BSI-C3A-SOV-2-02
• SOV-2-03 State of Defense Takeover – text [applied]
  BSI-C3A-SOV-2-03
• SOV-3 Data Sovereignty – text [applied]
  BSI-C3A-SOV-3
• SOV-3-01 Data Residence – text [applied]
  BSI-C3A-SOV-3-01
• SOV-3-02 External Key Management – text [applied]
  BSI-C3A-SOV-3-02
• SOV-3-03 External Identity Provider – text [applied]
  BSI-C3A-SOV-3-03
• SOV-3-04 Logging and Monitoring – text [applied]
  BSI-C3A-SOV-3-04
• SOV-3-05 Client-Side Encryption – text [applied]
  BSI-C3A-SOV-3-05
• SOV-4 Operational Sovereignty – text [applied]
  BSI-C3A-SOV-4
• SOV-4-01 Operating Personnel – text [applied]
  BSI-C3A-SOV-4-01
• SOV-4-02 Remote Work – text [applied]
  BSI-C3A-SOV-4-02
• SOV-4-03 Redundant connectivity providers – text [applied]
  BSI-C3A-SOV-4-03
• SOV-4-04 SOC – text [applied]
  BSI-C3A-SOV-4-04
• SOV-4-04-C1 – text [applied]
  BSI-C3A-SOV-4-04-C1
• SOV-4-04-C2 – text [applied]
  BSI-C3A-SOV-4-04-C2
• SOV-4-05 Ingress Data Control – text [applied]
  BSI-C3A-SOV-4-05
• SOV-4-06 Update threat analysis – text [applied]
  BSI-C3A-SOV-4-06
• SOV-4-07 Data exchange monitoring – text [applied]
  BSI-C3A-SOV-4-07
• SOV-4-08 Data exchange gateways – text [applied]
  BSI-C3A-SOV-4-08
• SOV-4-09 Disconnect – text [applied]
  BSI-C3A-SOV-4-09
• SOV-4-10 Reconnect – text [applied]
  BSI-C3A-SOV-4-10
• SOV-5 Supply Chain Sovereignty – text [applied]
  BSI-C3A-SOV-5
• SOV-5-01 Software Dependencies – text [applied]
  BSI-C3A-SOV-5-01
• SOV-5-02 Hardware Dependencies – text [applied]
  BSI-C3A-SOV-5-02
• SOV-5-03 External Service Dependencies – text [applied]
  BSI-C3A-SOV-5-03
• SOV-5-04 Export Restriction – text [applied]
  BSI-C3A-SOV-5-04
• SOV-5-05 Capacity Management – text [applied]
  BSI-C3A-SOV-5-05
• SOV-6 Technology Sovereignty – text [applied]
  BSI-C3A-SOV-6
• SOV-6-01 Source Code Availability – text [applied]
  BSI-C3A-SOV-6-01
• SOV-6-02 Continuous Service Delivery – text [applied]
  BSI-C3A-SOV-6-02
• SOV-6-03 Software Development – text [applied]
  BSI-C3A-SOV-6-03

Labels (2)

• Languages: English [applied]
• Applicable: Germany [applied]

New version: IT-Grundschutz Compendium Edition 2022 (2022-4cd3f72618) – 2334 new, 64 changed, 0 removed, 1 assignments, 7136 links

• Document: IT-Grundschutz Compendium Edition 2022 (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf?__blob=publicationFile&v=2)
• Version: 2022-4cd3f72618
• Project: BSI
• Import: #2415, 24.10.2026 10:18, bsi

The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).

Taken over directly (additional fields, HTML of an unchanged text): 91 issues.

Review: 0 open, 9535 applied, 0 rejected.

New sections (2334)

• ORP.4.A24 Dual Control for Administrative Activities [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) ORP.4.A24
• ORP.5 Compliance Management [applied]
  ITGC (1.2.2022) ORP.5
• ORP.5.G1. Violations of Legal Provisions [applied]
  BSI ITGC (01.02.2022) ORP.5.G1.
• ORP.5.G2. Improper Forwarding of Information [applied]
  BSI ITGC (01.02.2022) ORP.5.G2.
• ORP.5.G3. Inadequate Checking of the Identity of Communication Partners [applied]
  BSI ITGC (01.02.2022) ORP.5.G3.
• ORP.5.G4. Accidental Sharing of Internal Information [applied]
  BSI ITGC (01.02.2022) ORP.5.G4.
• ORP.5.A1 Identification of Framework Conditions [Central Administration, Top Management] (B) [applied]
  ITGC (1.2.2022) ORP.5.A1
• ORP.5.A2 Compliance with Framework Conditions [Supervisor, Central Administration, Top Management] (B) [applied]
  ITGC (1.2.2022) ORP.5.A2
• ORP.5.A4 Design and Organisation of Compliance Management [Top Management] (S) [applied]
  ITGC (1.2.2022) ORP.5.A4
• ORP.5.A5 Granting Exceptions [Supervisor, Chief Information Security Officer (CISO)] (S) [applied]
  ITGC (1.2.2022) ORP.5.A5
• ORP.5.A8 Regular Reviews of Compliance Management (S) [applied]
  ITGC (1.2.2022) ORP.5.A8
• CON.1 Crypto Concept [applied]
  ITGC (1.2.2022) CON.1
• CON.1.G1. Inadequate Key Management for Encryption [applied]
  BSI ITGC (01.02.2022) CON.1.G1.
• CON.1.G2. Violation of Legal Framework Conditions Regarding the Use of Cryptographic Methods [applied]
  BSI ITGC (01.02.2022) CON.1.G2.
• CON.1.G3. Loss of Data Confidentiality or Integrity Due to Misbehaviour [applied]
  BSI ITGC (01.02.2022) CON.1.G3.
• CON.1.G4. Software Vulnerabilities or Errors in Crypto Modules [applied]
  BSI ITGC (01.02.2022) CON.1.G4.
• CON.1.G5. Failure of a Crypto Module [applied]
  BSI ITGC (01.02.2022) CON.1.G5.
• CON.1.G6. Insecure Cryptographic Algorithms or Products [applied]
  BSI ITGC (01.02.2022) CON.1.G6.
• CON.1.G7. Errors in Encrypted Data or Cryptographic Keys [applied]
  BSI ITGC (01.02.2022) CON.1.G7.
• CON.1.G8. Unauthorised Use of a Crypto Module [applied]
  BSI ITGC (01.02.2022) CON.1.G8.
• CON.1.G9. Compromised Cryptographic Keys [applied]
  BSI ITGC (01.02.2022) CON.1.G9.
• CON.1.G10. Forged Certificates [applied]
  BSI ITGC (01.02.2022) CON.1.G10.
• CON.1.A1 Selecting Appropriate Cryptographic Methods [Process Owner] [applied]
  ITGC (1.2.2022) CON.1.A1
• CON.1.A2 Backups When Using Cryptographic Methods [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.1.A2
• CON.1.A3 Encryption of Communication Links (S) [applied]
  ITGC (1.2.2022) CON.1.A3
• CON.1.A4 Appropriate Key Management (S) [applied]
  ITGC (1.2.2022) CON.1.A4
• CON.1.A5 Secure Deletion and Destruction of Cryptographic Keys [IT Operation Department] (S) [applied]
  ITGC (1.2.2022) CON.1.A5
• CON.1.A6 Identifying the Need for Cryptographic Methods and Products [IT Operation Department, Process Owner] (S) [applied]
  ITGC (1.2.2022) CON.1.A6
• CON.1.A7 Drawing Up a Security Policy for the Use of Cryptographic Methods and Products (H) [applied]
  ITGC (1.2.2022) CON.1.A7
• CON.1.A8 Determining the Factors That Influence Cryptographic Methods and Products (H) [applied]
  ITGC (1.2.2022) CON.1.A8
• CON.1.A9 Selecting an Appropriate Cryptographic Product [IT Operation Department, Process Owner] (H) [applied]
  ITGC (1.2.2022) CON.1.A9
• CON.1.A10 Developing a Crypto Concept (H) [applied]
  ITGC (1.2.2022) CON.1.A10
• CON.1.A11 Secure Configuration of Crypto Modules [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A11
• CON.1.A12 Secure Separation of Roles When Using Crypto Modules [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A12
• CON.1.A13 Operating System Security Requirements When Using Crypto Modules (H) [applied]
  ITGC (1.2.2022) CON.1.A13
• CON.1.A14 Training of Users and Administrators [Supervisor, Process Owner, IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A14
• CON.1.A15 Reacting to the Practical Weakening of a Crypto Method (H) [applied]
  ITGC (1.2.2022) CON.1.A15
• CON.1.A16 Physical Protection of Crypto Modules [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A16
• CON.1.A17 Emission Security [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A17
• CON.1.A18 Cryptographic Replacement Modules [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.1.A18
• CON.2 Data Protection [applied]
  ITGC (1.2.2022) CON.2
• CON.2.G1. Non-Compliance with Data Protection Laws or Use of an Incomplete Risk Model [applied]
  BSI ITGC (01.02.2022) CON.2.G1.
• CON.2.G2. Definition of Insufficient Protection Needs [applied]
  BSI ITGC (01.02.2022) CON.2.G2.
• CON.2.A1 Implementing the German Standard Data Protection Model (B) [applied]
  ITGC (1.2.2022) CON.2.A1
• CON.3 Backup Concept [applied]
  ITGC (1.2.2022) CON.3
• CON.3.G1. Lack of Backups [applied]
  BSI ITGC (01.02.2022) CON.3.G1.
• CON.3.G2. Lack of Recovery Tests [applied]
  BSI ITGC (01.02.2022) CON.3.G2.
• CON.3.G3. Unsuitable Storage of Backup Media [applied]
  BSI ITGC (01.02.2022) CON.3.G3.
• CON.3.G4. Inadequate Documentation [applied]
  BSI ITGC (01.02.2022) CON.3.G4.
• CON.3.G5. Non-Compliance with Statutory Regulations [applied]
  BSI ITGC (01.02.2022) CON.3.G5.
• CON.3.G6. Using Insecure Providers for Online Backups [applied]
  BSI ITGC (01.02.2022) CON.3.G6.
• CON.3.G7. Insufficient Storage Capacity [applied]
  BSI ITGC (01.02.2022) CON.3.G7.
• CON.3.G8. Inadequate Backup Concept [applied]
  BSI ITGC (01.02.2022) CON.3.G8.
• CON.3.G9. Insufficient Data Backup Speed [applied]
  BSI ITGC (01.02.2022) CON.3.G9.
• CON.3.G10. Ransomware [applied]
  BSI ITGC (01.02.2022) CON.3.G10.
• CON.3.A1 Determining the Factors That Influence Backups [Process Owner, IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A1
• CON.3.A2 Establishment of Backup Procedures [Process Owner, IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A2
• CON.3.A4 Creating Backup Plans [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A4
• CON.3.A5 Regular Backups [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A5
• CON.3.A12 Secure Storage of Backup Media [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A12
• CON.3.A14 Protection of Backups [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A14
• CON.3.A15 Regular Backup Testing [IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.3.A15
• CON.3.A6 Developing a Backup Concept [Process Owner, IT Operation Department] (S) [applied]
  ITGC (1.2.2022) CON.3.A6
• CON.3.A7 Procuring a Suitable Backup System [IT Operation Department] (S) [applied]
  ITGC (1.2.2022) CON.3.A7
• CON.3.A9 Prerequisites of Online Backups [IT Operation Department] (S) [applied]
  ITGC (1.2.2022) CON.3.A9
• CON.3.A13 Using Cryptographic Methods for Backups [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.3.A13
• CON.6 Deleting and Destroying Data and Devices [applied]
  ITGC (1.2.2022) CON.6
• CON.6.G1. Non-Existent or Insufficiently Documented Regulations for Deletion and Destruction [applied]
  BSI ITGC (01.02.2022) CON.6.G1.
• CON.6.G2. Loss of Confidentiality due to Residual Information on Storage Media [applied]
  BSI ITGC (01.02.2022) CON.6.G2.
• CON.6.G3. Inappropriate Involvement of External Service Providers in the Deletion and Destruction Process [applied]
  BSI ITGC (01.02.2022) CON.6.G3.
• CON.6.G4. Inappropriate Handling of Defective Storage Media or IT Devices [applied]
  BSI ITGC (01.02.2022) CON.6.G4.
• CON.6.A1 Regulations for Deleting or Destroying Information [Central Administration, Process Owner, Data Protection Officer, IT Operation Department]… [applied]
  ITGC (1.2.2022) CON.6.A1
• CON.6.A2 Proper Deletion and Destruction of Sensitive Resources and Information (B) [applied]
  ITGC (1.2.2022) CON.6.A2
• CON.6.A11 Deletion and Destruction of Storage Media by External Service Providers (B) [applied]
  ITGC (1.2.2022) CON.6.A11
• CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B) [applied]
  ITGC (1.2.2022) CON.6.A12
• CON.6.A4 Selecting Suitable Methods for Deleting or Destroying Storage Media (S) [applied]
  ITGC (1.2.2022) CON.6.A4
• CON.6.A8 Creating a Policy for Deleting and Destroying Information [Employee, IT Operation Department, Data Protection Officer] (S) [applied]
  ITGC (1.2.2022) CON.6.A8
• CON.6.A13 Destruction of Defective Digital Storage Media (S) [applied]
  ITGC (1.2.2022) CON.6.A13
• CON.6.A14 Destruction of Storage Media at Increased Security Levels (H) [applied]
  ITGC (1.2.2022) CON.6.A14
• CON.7 Information Security on Trips Abroad [applied]
  ITGC (1.2.2022) CON.7
• CON.7.G1. Eavesdropping and Spying on Information/Industrial Espionage [applied]
  BSI ITGC (01.02.2022) CON.7.G1.
• CON.7.G2. Disclosure and Misuse of Sensitive Information (Electronic and Physical) [applied]
  BSI ITGC (01.02.2022) CON.7.G2.
• CON.7.G3. Use of False Identities [applied]
  BSI ITGC (01.02.2022) CON.7.G3.
• CON.7.G4. Lack of Security Awareness and Carelessness in Handling Information [applied]
  BSI ITGC (01.02.2022) CON.7.G4.
• CON.7.G5. Violation of Local Laws or Regulations [applied]
  BSI ITGC (01.02.2022) CON.7.G5.
• CON.7.G6. Coercion, Extortion, Hijacking, and Corruption [applied]
  BSI ITGC (01.02.2022) CON.7.G6.
• CON.7.G7. Information from Unreliable Sources [applied]
  BSI ITGC (01.02.2022) CON.7.G7.
• CON.7.G8. Theft or Loss of Devices, Storage Media, and Documents [applied]
  BSI ITGC (01.02.2022) CON.7.G8.
• CON.7.A1 Security Policy for Information Security on Trips Abroad [applied]
  ITGC (1.2.2022) CON.7.A1
• CON.7.A2 Raising Employee Awareness of Information Security When Travelling Abroad (B) [applied]
  ITGC (1.2.2022) CON.7.A2
• CON.7.A3 Identification of Country-Specific Regulations, Travel Conditions and Environmental Conditions [Human Resource Department] [applied]
  ITGC (1.2.2022) CON.7.A3
• CON.7.A4 Use of Privacy Screens [User] (B) [applied]
  ITGC (1.2.2022) CON.7.A4
• CON.7.A5 Use of Screen/Code Locking [User] (B) [applied]
  ITGC (1.2.2022) CON.7.A5
• CON.7.A6 Prompt Reporting of a Loss [User] [applied]
  ITGC (1.2.2022) CON.7.A6
• CON.7.A7 Secure Remote Access to an Organisation's Network [IT Operation Department, User] (B) [applied]
  ITGC (1.2.2022) CON.7.A7
• CON.7.A8 Secure Use of Public WLANs [User] (B) [applied]
  ITGC (1.2.2022) CON.7.A8
• CON.7.A9 Secure Handling of Mobile Storage Media [User] (B) [applied]
  ITGC (1.2.2022) CON.7.A9
• CON.7.A10 Encryption of Portable IT Systems and Storage Media [User, IT Operation Department] (B) [applied]
  ITGC (1.2.2022) CON.7.A10
• CON.7.A12 Secure Destruction of Sensitive Materials and Documents [User] (B) [applied]
  ITGC (1.2.2022) CON.7.A12
• CON.7.A11 Use of Anti-Theft Devices [User] (S) [applied]
  ITGC (1.2.2022) CON.7.A11
• CON.7.A13 Transporting Necessary Data and Storage Media [User] (S) [applied]
  ITGC (1.2.2022) CON.7.A13
• CON.7.A14 Cryptographically Secured E-Mail Communication [User, IT Operation Department] (S) [applied]
  ITGC (1.2.2022) CON.7.A14
• CON.7.A15 Emission Security for Portable IT Systems (H) [applied]
  ITGC (1.2.2022) CON.7.A15
• CON.7.A16 Protecting Integrity Using Checksums or Digital Signatures [User] (H) [applied]
  ITGC (1.2.2022) CON.7.A16
• CON.7.A17 Use of Dedicated Travel Hardware [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.7.A17
• CON.7.A18 Restricted Authorisations on Trips Abroad [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.7.A18
• CON.8 Software Development [applied]
  ITGC (1.2.2022) CON.8
• CON.8.G1. Selection of an Unsuitable Process Model [applied]
  BSI ITGC (01.02.2022) CON.8.G1.
• CON.8.G2. Selection of an Unsuitable Development Environment [applied]
  BSI ITGC (01.02.2022) CON.8.G2.
• CON.8.G3. Inadequate Quality Assurance in the Development Process [applied]
  BSI ITGC (01.02.2022) CON.8.G3.
• CON.8.G4. Inadequate Documentation [applied]
  BSI ITGC (01.02.2022) CON.8.G4.
• CON.8.G5. Inadequately Secured Use of Development Environments [applied]
  BSI ITGC (01.02.2022) CON.8.G5.
• CON.8.G6. Software Design Errors [applied]
  BSI ITGC (01.02.2022) CON.8.G6.
• CON.8.G7. Inadequate Testing and Approval Procedures [applied]
  BSI ITGC (01.02.2022) CON.8.G7.
• CON.8.G8. Software Testing with Production Data [applied]
  BSI ITGC (01.02.2022) CON.8.G8.
• CON.8.A2 Selection of a Process Model (B) [applied]
  ITGC (1.2.2022) CON.8.A2
• CON.8.A3 Selection of a Development Environment (B) [applied]
  ITGC (1.2.2022) CON.8.A3
• CON.8.A5 Secure System Design (B) [applied]
  ITGC (1.2.2022) CON.8.A5
• CON.8.A6 Use of External Libraries from Trusted Sources (B) [applied]
  ITGC (1.2.2022) CON.8.A6
• CON.8.A7 Conducting Software Tests During Development [Tester, Developer] (B) [applied]
  ITGC (1.2.2022) CON.8.A7
• CON.8.A8 Provision of Patches, Updates, and Changes [Developer] (B) [applied]
  ITGC (1.2.2022) CON.8.A8
• CON.8.A10 Source Code Version Management [Developer] (B) [applied]
  ITGC (1.2.2022) CON.8.A10
• CON.8.A20 Checking External Components (B) [applied]
  ITGC (1.2.2022) CON.8.A20
• CON.8.A1 Definition of Roles and Responsibilities [Central Administration] (S) [applied]
  ITGC (1.2.2022) CON.8.A1
• CON.8.A11 Drawing Up a Policy for Software Development (S) [applied]
  ITGC (1.2.2022) CON.8.A11
• CON.8.A12 Detailed Documentation (S) [applied]
  ITGC (1.2.2022) CON.8.A12
• CON.8.A14 Training Development Teams on Information Security (S) [applied]
  ITGC (1.2.2022) CON.8.A14
• CON.8.A16 Appropriate Control of Software Development (S) [applied]
  ITGC (1.2.2022) CON.8.A16
• CON.8.A21 Threat Modelling (S) [applied]
  ITGC (1.2.2022) CON.8.A21
• CON.8.A22 Secure Software Design (S) [applied]
  ITGC (1.2.2022) CON.8.A22
• CON.8.A17 Selection of Trusted Development Tools (H) [applied]
  ITGC (1.2.2022) CON.8.A17
• CON.8.A18 Periodic Security Audits of the Development Environment (H) [applied]
  ITGC (1.2.2022) CON.8.A18
• CON.8.A19 Regular Integrity Audits of the Development Environment [IT Operation Department] (H) [applied]
  ITGC (1.2.2022) CON.8.A19
• CON.9 Information Exchange [applied]
  ITGC (1.2.2022) CON.9
• CON.9.G1. Delayed Availability of Information [applied]
  BSI ITGC (01.02.2022) CON.9.G1.
• CON.9.G2. Unregulated Forwarding of information [applied]
  BSI ITGC (01.02.2022) CON.9.G2.
• CON.9.G3. Sharing False or Internal Information [applied]
  BSI ITGC (01.02.2022) CON.9.G3.
• CON.9.G4. Unauthorised Copying and Modification of Information [applied]
  BSI ITGC (01.02.2022) CON.9.G4.
• CON.9.G5. Inadequate Application of Encryption Procedures [applied]
  BSI ITGC (01.02.2022) CON.9.G5.
• CON.9.A1 Definition of Authorised Recipients [Central Administration, Users] (B) [applied]
  ITGC (1.2.2022) CON.9.A1
• CON.9.A2 Regulating the Exchange of Information [Central Administration, User] (B) [applied]
  ITGC (1.2.2022) CON.9.A2
• CON.9.A3 Instruction of Personnel on Exchanges of Information [Process Owner] (B) [applied]
  ITGC (1.2.2022) CON.9.A3
• CON.9.A4 Agreements on Exchanging Information with External Parties [Central Administration] (S) [applied]
  ITGC (1.2.2022) CON.9.A4
• CON.9.A5 Removal of Residual Information Prior to Sharing [User] (S) [applied]
  ITGC (1.2.2022) CON.9.A5
• CON.9.A6 Compatibility Checks on Sender and Recipient Systems (S) [applied]
  ITGC (1.2.2022) CON.9.A6
• CON.9.A7 Backup Copies of Transferred Data [User] (S) [applied]
  ITGC (1.2.2022) CON.9.A7
• CON.9.A8 Encryption and Digital Signatures (S) [applied]
  ITGC (1.2.2022) CON.9.A8
• CON.9.A9 Confidentiality Agreements [Central Administration, User] (H) [applied]
  ITGC (1.2.2022) CON.9.A9
• CON.10 Development of Web Applications [applied]
  ITGC (1.2.2022) CON.10
• CON.10.G1. Bypassing Authorisations in Web Applications [applied]
  BSI ITGC (01.02.2022) CON.10.G1.
• CON.10.G2. Insufficient Input Validation and Output Encoding [applied]
  BSI ITGC (01.02.2022) CON.10.G2.
• CON.10.G3. Insufficient Error Handling by Web Applications [applied]
  BSI ITGC (01.02.2022) CON.10.G3.
• CON.10.G4. Insufficient Logging of Security-Relevant Events [applied]
  BSI ITGC (01.02.2022) CON.10.G4.
• CON.10.G5. Disclosure of Security-Relevant Information Through Web Applications [applied]
  BSI ITGC (01.02.2022) CON.10.G5.
• CON.10.G6. Misuse of a Web Application Due to Automated Use [applied]
  BSI ITGC (01.02.2022) CON.10.G6.
• CON.10.G7. Inadequate Session Management in Web Applications [applied]
  BSI ITGC (01.02.2022) CON.10.G7.
• CON.10.A1 Authentication for Web Applications (B) [applied]
  ITGC (1.2.2022) CON.10.A1
• CON.10.A2 Access Control for Web Applications (B) [applied]
  ITGC (1.2.2022) CON.10.A2
• CON.10.A3 Secure Session Management (B) [applied]
  ITGC (1.2.2022) CON.10.A3
• CON.10.A4 Controlled Integration of Content in Web Applications (B) [applied]
  ITGC (1.2.2022) CON.10.A4
• CON.10.A5 Upload Functions (B) [applied]
  ITGC (1.2.2022) CON.10.A5
• CON.10.A6 Protection Against Unauthorised Automated Use of Web Applications (B) [applied]
  ITGC (1.2.2022) CON.10.A6
• CON.10.A7 Protection of Confidential Data (B) [applied]
  ITGC (1.2.2022) CON.10.A7
• CON.10.A8 Comprehensive Input Validation and Output Encoding (B) [applied]
  ITGC (1.2.2022) CON.10.A8
• CON.10.A9 Protection Against SQL Injections (B) [applied]
  ITGC (1.2.2022) CON.10.A9
• CON.10.A10 Restrictive Disclosure of Security-Related Information (B) [applied]
  ITGC (1.2.2022) CON.10.A10
• CON.10.A11 Software Architecture of a Web Application (S) [applied]
  ITGC (1.2.2022) CON.10.A11
• CON.10.A12 Verification of Essential Changes (S) [applied]
  ITGC (1.2.2022) CON.10.A12
• CON.10.A13 Error Handling (S) [applied]
  ITGC (1.2.2022) CON.10.A13
• CON.10.A14 Secure HTTP Configuration of Web Applications (S) [applied]
  ITGC (1.2.2022) CON.10.A14
• CON.10.A15 Prevention of Cross-Site Request Forgery (S) [applied]
  ITGC (1.2.2022) CON.10.A15
• CON.10.A16 Multi-Factor Authentication (S) [applied]
  ITGC (1.2.2022) CON.10.A16
• CON.10.A17 Preventing Resources from Being Blocked (H) [applied]
  ITGC (1.2.2022) CON.10.A17
• CON.10.A18 Cryptographic Protection of Confidential Data (H) [applied]
  ITGC (1.2.2022) CON.10.A18
• OPS.1.1.2 Proper IT Administration [applied]
  ITGC (1.2.2022) OPS.1.1.2
• OPS.1.1.2.G1. Failures Caused by Unspecified Responsibilities [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G1.
• OPS.1.1.2.G2. Shortage of Personnel with Core Competencies [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G2.
• OPS.1.1.2.G3. Misuse of Administrative Authorisations [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G3.
• OPS.1.1.2.G4. Inadequate Consideration of Administrative Tasks [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G4.
• OPS.1.1.2.G5. Operational Disruptions [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G5.
• OPS.1.1.2.G6. Lack of Options for Investigating Incidents [applied]
  BSI ITGC (01.02.2022) OPS.1.1.2.G6.
• OPS.1.1.2.A2 Deputising Rules and Contingency Planning (B) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A2
• OPS.1.1.2.A3 Controlled Hiring of IT Administrators (B) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A3
• OPS.1.1.2.A4 Termination of IT Administration Duties [Human Resources Department] (B) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A4
• OPS.1.1.2.A5 Verifying Administrative Tasks (B) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A5
• OPS.1.1.2.A6 Protecting Administrative Tasks (B) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A6
• OPS.1.1.2.A7 Regulation of IT Administration Tasks (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A7
• OPS.1.1.2.A8 Administration of Specialised Applications (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A8
• OPS.1.1.2.A9 Sufficient Resources for the IT Operation Department (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A9
• OPS.1.1.2.A10 Further Education and Information (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A10
• OPS.1.1.2.A11 Documentation of IT Administration Tasks (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A11
• OPS.1.1.2.A12 Provisions for Maintenance and Repairs (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A12
• OPS.1.1.2.A20 Administration and Commissioning of Devices (S) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A20
• OPS.1.1.2.A14 Security Vetting of Administrators [Human Resources Department] (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A14
• OPS.1.1.2.A15 Division of Administrative Activities (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A15
• OPS.1.1.2.A16 Access Restrictions for Administrative Access (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A16
• OPS.1.1.2.A17 Dual Control in IT Administration (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A17
• OPS.1.1.2.A18 Consistent Logging of Administrative Activities (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A18
• OPS.1.1.2.A19 Consideration of High-Availability Requirements (H) [applied]
  ITGC (1.2.2022) OPS.1.1.2.A19
• OPS.1.1.3 Patch and Change Management [applied]
  ITGC (1.2.2022) OPS.1.1.3
• … and 2134 more

Changed sections (64)

• G 0.1 Fire – text [applied]
  BSI ITGC (01.02.2022) G 0.1
• G 0.2 Unfavourable Climatic Conditions – text [applied]
  BSI ITGC (01.02.2022) G 0.2
• G 0.3 Water – text [applied]
  BSI ITGC (01.02.2022) G 0.3
• G 0.4 Pollution, Dust, Corrosion – text [applied]
  BSI ITGC (01.02.2022) G 0.4
• G 0.5 Natural Disasters – text [applied]
  BSI ITGC (01.02.2022) G 0.5
• G 0.6 Catastrophes in the Vicinity – text [applied]
  BSI ITGC (01.02.2022) G 0.6
• G 0.7 Major Events in the Vicinity – text [applied]
  BSI ITGC (01.02.2022) G 0.7
• G 0.8 Failure or Disruption of the Power Supply – text [applied]
  BSI ITGC (01.02.2022) G 0.8
• G 0.9 Failure or Disruption of Communication Networks – text [applied]
  BSI ITGC (01.02.2022) G 0.9
• G 0.10 Failure or Disruption of Supply Networks – text [applied]
  BSI ITGC (01.02.2022) G 0.10
• G 0.11 Failure or Disruption of Service Providers – text [applied]
  BSI ITGC (01.02.2022) G 0.11
• G 0.14 Interception of Information / Espionage – text [applied]
  BSI ITGC (01.02.2022) G 0.14
• G 0.15 Eavesdropping – text [applied]
  BSI ITGC (01.02.2022) G 0.15
• G 0.16 Theft of Devices, Storage Media and Documents – text [applied]
  BSI ITGC (01.02.2022) G 0.16
• G 0.17 Loss of Devices, Storage Media and Documents – text [applied]
  BSI ITGC (01.02.2022) G 0.17
• G 0.18 Poor Planning or Lack of Adaptation – text [applied]
  BSI ITGC (01.02.2022) G 0.18
• G 0.19 Disclosure of Sensitive Information – text [applied]
  BSI ITGC (01.02.2022) G 0.19
• G 0.20 Information or Products from an Unreliable Source – text [applied]
  BSI ITGC (01.02.2022) G 0.20
• G 0.21 Manipulation with Hardware or Software – text [applied]
  BSI ITGC (01.02.2022) G 0.21
• G 0.22 Manipulation of Information – text [applied]
  BSI ITGC (01.02.2022) G 0.22
• G 0.23 Unauthorised Access to IT Systems – text [applied]
  BSI ITGC (01.02.2022) G 0.23
• G 0.24 Destruction of Devices or Storage Media – text [applied]
  BSI ITGC (01.02.2022) G 0.24
• G 0.25 Failure of Devices or Systems – text [applied]
  BSI ITGC (01.02.2022) G 0.25
• G 0.26 Malfunction of Devices or Systems – text [applied]
  BSI ITGC (01.02.2022) G 0.26
• G 0.27 Lack of Resources – text [applied]
  BSI ITGC (01.02.2022) G 0.27
• G 0.28 Software Vulnerabilities or Errors – text [applied]
  BSI ITGC (01.02.2022) G 0.28
• G 0.29 Violations of Laws or Regulations – text [applied]
  BSI ITGC (01.02.2022) G 0.29
• G 0.30 Unauthorised Use or Administration of Devices and Systems – text [applied]
  BSI ITGC (01.02.2022) G 0.30
• G 0.32 Misuse of Authorisation – text [applied]
  BSI ITGC (01.02.2022) G 0.32
• G 0.33 Shortage of Personnel – text [applied]
  BSI ITGC (01.02.2022) G 0.33
• G 0.34 Assault – text [applied]
  BSI ITGC (01.02.2022) G 0.34
• G 0.36 Identity theft – text [applied]
  BSI ITGC (01.02.2022) G 0.36
• G 0.37 Repudiation of Actions – text [applied]
  BSI ITGC (01.02.2022) G 0.37
• G 0.38 Misuse of Personal Information – text [applied]
  BSI ITGC (01.02.2022) G 0.38
• G 0.39 Malware – text [applied]
  BSI ITGC (01.02.2022) G 0.39
• G 0.40 Denial of Service – text [applied]
  BSI ITGC (01.02.2022) G 0.40
• G 0.41 Sabotage – text [applied]
  BSI ITGC (01.02.2022) G 0.41
• G 0.42 Social Engineering – text [applied]
  BSI ITGC (01.02.2022) G 0.42
• G 0.43 Attack with Specially Crafted Messages – text [applied]
  BSI ITGC (01.02.2022) G 0.43
• G 0.44 Unauthorised Entry to Premises – text [applied]
  BSI ITGC (01.02.2022) G 0.44
• G 0.45 Data Loss – text [applied]
  BSI ITGC (01.02.2022) G 0.45
• G 0.46 Loss of Integrity of Sensitive Information – text [applied]
  BSI ITGC (01.02.2022) G 0.46
• G 0.47 Harmful Side Effects of IT-Supported Attacks – title, text (before: G 0.47 Harmful Side Effects of IT_x0002_Supported Attack) [applied]
  BSI ITGC (01.02.2022) G 0.47
• ISMS.1 Security Management – text [applied]
  ITGC (1.2.2022) ISMS.1
• ISMS.1.G9. Uneconomical Use of Resources due to Inadequate Security Management – text [applied]
  BSI ITGC (01.02.2022) ISMS.1.G9.
• ORP.1 Organisation – text [applied]
  ITGC (1.2.2022) ORP.1
• ORP.1.G2. Non-Compliance with Regulations – text [applied]
  BSI ITGC (01.02.2022) ORP.1.G2.
• ORP.1.G3. Inadequate or Incompatible Resources – text [applied]
  BSI ITGC (01.02.2022) ORP.1.G3.
• ORP.1.G4. Threats from Outside the Organisation – text [applied]
  BSI ITGC (01.02.2022) ORP.1.G4.
• ORP.1.A16 Policy for Secure IT Use [User] (S) – text [applied]
  ITGC (1.2.2022) ORP.1.A16
• ORP.2 Personnel – text [applied]
  ITGC (1.2.2022) ORP.2
• ORP.3 Awareness and Training in Information Security – text [applied]
  ITGC (1.2.2022) ORP.3
• ORP.3.G3. Ineffective Awareness and Training Activities – text [applied]
  BSI ITGC (01.02.2022) ORP.3.G3.
• ORP.4 Identity and Access Management – text [applied]
  ITGC (1.2.2022) ORP.4
• ORP.4.A22 Regulating Password Quality [IT Operation Department] (B) – title, text (before: ORP.4.A24 Dual Control for Administrative Activities [IT Operation Department] (H)) [applied]
  ITGC (1.2.2022) ORP.4.A22
• ORP.4.A15 Approach and Design of Identity and Access Management Processes [IT Operation Department] (S) – text [applied]
  ITGC (1.2.2022) ORP.4.A15
• Concepts and Procedures – title (before: concepts and methodologies) [applied]
  ITGC (1.2.2022) CON
• Operations – title (before: operational) [applied]
  ITGC (1.2.2022) OPS
• Detection and Response – title (before: Detect and Response) [applied]
  ITGC (1.2.2022) DER
• Applications – title (before: Application) [applied]
  ITGC (1.2.2022) APP
• IT Systems – title (before: Systems) [applied]
  ITGC (1.2.2022) SYS
• Industrial IT – title (before: Individual) [applied]
  ITGC (1.2.2022) IND
• Networks and Communication – title (before: Network) [applied]
  ITGC (1.2.2022) NET
• Infrastructure – title (before: Infrastrucuture) [applied]
  ITGC (1.2.2022) INF

Labels (1)

• Applicable: Germany [applied]

New links (7136)

• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A1
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ISMS.1.A1
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A2
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A3
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A4
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ISMS.1.A4
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A5
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A6
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A7
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A8
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ISMS.1.A8
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A9
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A10
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A11
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ISMS.1.A11
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ISMS.1.A12
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A13
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A15
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ISMS.1.A15
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A16
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ISMS.1.A16
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ISMS.1.A17
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A1
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.25 Failure of Devices or Systems [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.26 Malfunction of Devices or Systems [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A2
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A3
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.1.A3
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A3
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.1.A3
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A4
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.1.A4
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.1.A4
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A4
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A15
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A8
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.1.A8
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.1.A8
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A8
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ORP.1.A8
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.25 Failure of Devices or Systems [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.26 Malfunction of Devices or Systems [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A13
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.1.A16
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A1
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.44 Unauthorised Entry to Premises [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A2
• Blocks → G 0.17 Loss of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A3
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A3
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.2.A3
• Blocks → G 0.17 Loss of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A4
• Blocks → G 0.44 Unauthorised Entry to Premises [applied]
  ITGC (1.2.2022) ORP.2.A4
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.2.A4
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A4
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.17 Loss of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.27 Lack of Resources [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.33 Shortage of Personnel [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.44 Unauthorised Entry to Premises [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A5
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A14
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.2.A14
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A14
• Blocks → G 0.41 Sabotage [applied]
  ITGC (1.2.2022) ORP.2.A14
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A14
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A15
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.2.A7
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A7
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.2.A7
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.2.A7
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.2.A7
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.2.A13
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.2.A13
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.2.A13
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.2.A13
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.15 Eavesdropping [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.24 Destruction of Devices or Storage Media [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.30 Unauthorised Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.31 Incorrect Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A1
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.15 Eavesdropping [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.24 Destruction of Devices or Storage Media [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.30 Unauthorised Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.31 Incorrect Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A3
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A4
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A6
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.15 Eavesdropping [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.24 Destruction of Devices or Storage Media [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.30 Unauthorised Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.31 Incorrect Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.3.A7
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A8
• Blocks → G 0.14 Interception of Information / Espionage [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.15 Eavesdropping [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.19 Disclosure of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.24 Destruction of Devices or Storage Media [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.30 Unauthorised Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.31 Incorrect Use or Administration of Devices and Systems [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.36 Identity theft [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.38 Misuse of Personal Information [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.42 Social Engineering [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.45 Data Loss [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.46 Loss of Integrity of Sensitive Information [applied]
  ITGC (1.2.2022) ORP.3.A9
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.4.A1
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.4.A2
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.4.A3
• Blocks → G 0.22 Manipulation of Information [applied]
  ITGC (1.2.2022) ORP.4.A4
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.4.A4
• Blocks → G 0.32 Misuse of Authorisation [applied]
  ITGC (1.2.2022) ORP.4.A4
• Blocks → G 0.37 Repudiation of Actions [applied]
  ITGC (1.2.2022) ORP.4.A4
• Blocks → G 0.16 Theft of Devices, Storage Media and Documents [applied]
  ITGC (1.2.2022) ORP.4.A5
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.4.A5
• Blocks → G 0.29 Violations of Laws or Regulations [applied]
  ITGC (1.2.2022) ORP.4.A5
• Blocks → G 0.44 Unauthorised Entry to Premises [applied]
  ITGC (1.2.2022) ORP.4.A5
• Blocks → G 0.18 Poor Planning or Lack of Adaptation [applied]
  ITGC (1.2.2022) ORP.4.A6
• Blocks → G 0.23 Unauthorised Access to IT Systems [applied]
  ITGC (1.2.2022) ORP.4.A6
• … and 6936 more