BSI
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)
Inga dokument på detta språk, de engelska visas.
Cloud Computing Compliance Criteria Catalogue (C5:2026)
Ärenden
| Rubrik |
Källa |
|
+ Cloud Computing Compliance Criteria Catalogue (C5:2026)
|
|
|
---+ Asset Management (AM)
|
|
|
------+ AM-01 Asset Management Framework
|
|
|
---------+ AM-01.01B
|
|
|
---------+ AM-01.01AC
|
|
|
---------+ AM-01.02AC
|
|
|
---------+ AM-01.02AC
|
|
|
------+ AM-02 Asset Inventory
|
|
|
---------+ AM-02.01B
|
|
|
---------+ AM-02.02B
|
|
|
---------+ AM-02.03B
|
|
|
---------+ AM-02.04B
|
|
|
---------+ AM-02.05B
|
|
|
------+ AM-03 Hardware Asset Inventory
|
|
|
---------+ AM-03.01B
|
|
|
------+ AM-04 Software Asset Inventory
|
|
|
---------+ AM-04.01B
|
|
|
---------+ AM-04.01AC
|
|
|
------+ AM-05 Policy for the Proper and Secure Use of Assets
|
|
|
---------+ AM-05.01B
|
|
|
---------+ AM-05.02B
|
|
|
------+ AM-06 Commissioning of Hardware
|
|
|
---------+ AM-06.01B
|
|
|
---------+ AM-06.02B
|
|
|
------+ AM-07 Decommissioning of Hardware
|
|
|
---------+ AM-07.01B
|
|
|
---------+ AM-07.02B
|
|
|
---------+ AM-07.01AC
|
|
|
---------+ AM-07.01AS
|
|
|
------+ AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets
|
|
|
---------+ AM-08.01B
|
|
|
---------+ AM-08.02B
|
|
|
---------+ AM-08.03B
|
|
|
------+ AM-09 Asset Classification and Labelling
|
|
|
---------+ AM-09.01B
|
|
|
---------+ AM-09.02B
|
|
|
---------+ AM-09.03B
|
|
|
---------+ AM-09.04B
|
|
|
---------+ AM-09.01AC
|
|
|
---------+ AM-09.02AC
|
|
|
---------+ AM-09.03AC
|
|
|
---------+ AM-09.04AC
|
|
|
---------+ AM-09 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ AM-10 Protection of Hardware on Hold
|
|
|
---------+ AM-10.01B
|
|
|
---------+ AM-10.01AS
|
|
|
------+ AM-11 Transfer of Hardware
|
|
|
---------+ AM-11.01B
|
|
|
---------+ AM-11.02B
|
|
|
---------+ AM-11.03B
|
|
|
------+ AM-12 Removable Media and Endpoint Devices
|
|
|
---------+ AM-12.01B
|
|
|
---------+ AM-12.01AC
|
|
|
---+ Business Continuity Management (BCM)
|
|
|
------+ BCM-01 Business Continuity and Emergency Management System
|
|
|
---------+ BCM-01.01B
|
|
|
---------+ BCM-01.02B
|
|
|
---------+ BCM-01.03B
|
|
|
---------+ BCM-01.04B
|
|
|
------+ BCM-02 Business Impact Analysis
|
|
|
---------+ BCM-02.01B
|
|
|
---------+ BCM-02.02B
|
|
|
---------+ BCM-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ BCM-03 Business Continuity Plans
|
|
|
---------+ BCM-03.01B
|
|
|
---------+ BCM-03.02B
|
|
|
---------+ BCM-03 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ BCM-04 Testing Business Continuity
|
|
|
---------+ BCM-04.01B
|
|
|
---------+ BCM-04.02B
|
|
|
---------+ BCM-04.01AC
|
|
|
---------+ BCM-04.02AC
|
|
|
---------+ BCM-04.03AC
|
|
|
---------+ BCM-04.04AC
|
|
|
---------+ BCM-04 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Compliance (COM)
|
|
|
------+ COM-01 Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements
|
|
|
---------+ COM-01.01B
|
|
|
---------+ COM-01.01AC
|
|
|
------+ COM-02 Policy for Planning and Conducting Audits
|
|
|
---------+ COM-02.01B
|
|
|
---------+ COM-02.02B
|
|
|
---------+ COM-02.01AC
|
|
|
---------+ COM-02.01AS
|
|
|
---------+ COM-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ COM-03 Internal Audits of the Information Security Management System
|
|
|
---------+ COM-03.01B
|
|
|
---------+ COM-03.02B
|
|
|
---------+ COM-03.03B
|
|
|
---------+ COM-03.01AC
|
|
|
---------+ COM-03.02AC
|
|
|
---------+ COM-03.03AC
|
|
|
------+ COM-04 Information on Information Security Performance and Management Assessment of the ISMS
|
|
|
---------+ COM-04.01B
|
|
|
---------+ COM-04.01AC
|
|
|
---------+ COM-04.02AC
|
|
|
---+ Communication Security (COS)
|
|
|
------+ COS-01 Technical Safeguards
|
|
|
---------+ COS-01.01B
|
|
|
---------+ COS-01.02B
|
|
|
---------+ COS-01.03B
|
|
|
---------+ COS-01.01AC
|
|
|
---------+ COS-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ COS-02 Security Requirements for Connections in the Cloud Service Provider's Network
|
|
|
---------+ COS-02.01B
|
|
|
------+ COS-03 Monitoring of Connections in the Cloud Service Provider's Network
|
|
|
---------+ COS-03.01B
|
|
|
---------+ COS-03.02B
|
|
|
---------+ COS-03.03B
|
|
|
---------+ COS-03.04B
|
|
|
---------+ COS-03.05B
|
|
|
---------+ COS-03 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ COS-04 Cross-Network Access
|
|
|
---------+ COS-04.01B
|
|
|
---------+ COS-04.02B
|
|
|
---------+ COS-04.01AS
|
|
|
---------+ COS-04 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ COS-05 Networks for Administration
|
|
|
---------+ COS-05.01B
|
|
|
---------+ COS-05.02B
|
|
|
---------+ COS-05.01AC
|
|
|
------+ COS-06 Separation of Data Traffic in Jointly Used Network Environments
|
|
|
---------+ COS-06.01B
|
|
|
---------+ COS-06.01AC
|
|
|
---------+ COS-06 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ COS-07 Documentation of the Network Topology
|
|
|
---------+ COS-07.01B
|
|
|
---------+ COS-07.02B
|
|
|
---------+ COS-07.03B
|
|
|
---------+ COS-07.04B
|
|
|
------+ COS-08 Policies for Data Transmission
|
|
|
---------+ COS-08.01B
|
|
|
---------+ COS-08.02B
|
|
|
---------+ COS-08 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Cryptography and Key Management (CRY)
|
|
|
------+ CRY-01 Policy for the Use of Cryptographic Mechanisms
|
|
|
---------+ CRY-01.01B
|
|
|
---------+ CRY-01.02B
|
|
|
---------+ CRY-01.01AC
|
|
|
---------+ CRY-01.02AC
|
|
|
---------+ CRY-01.03AC
|
|
|
------+ CRY-02 Cryptographic Change Management
|
|
|
---------+ CRY-02.01B
|
|
|
---------+ CRY-02.02B
|
|
|
---------+ CRY-02.03B
|
|
|
---------+ CRY-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ CRY-03 Review of Cryptography Practices
|
|
|
---------+ CRY-03.01B
|
|
|
---------+ CRY-03.02B
|
|
|
------+ CRY-04 Protection of Data for Transmission (Transport Protection)
|
|
|
---------+ CRY-04.01B
|
|
|
---------+ CRY-04.02B
|
|
|
---------+ CRY-04.01AS
|
|
|
---------+ CRY-04 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ CRY-05 Encryption of Sensitive Data at Rest
|
|
|
---------+ CRY-05.01B
|
|
|
---------+ CRY-05.02B
|
|
|
---------+ CRY-05.03B
|
|
|
---------+ CRY-05.04B
|
|
|
---------+ CRY-05.05B
|
|
|
---------+ CRY-05.01AC
|
|
|
---------+ CRY-05 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ CRY-06 Secure Key Generation
|
|
|
---------+ CRY-06.01B
|
|
|
------+ CRY-07 Rotation of Cryptographic Keys
|
|
|
---------+ CRY-07.01B
|
|
|
------+ CRY-08 Public-Key Certificate Issuance
|
|
|
---------+ CRY-08.01B
|
|
|
---------+ CRY-08 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ CRY-09 Secure Key Provisioning
|
|
|
---------+ CRY-09.01B
|
|
|
---------+ CRY-09.02B
|
|
|
------+ CRY-10 Secure Storage of Keys
|
|
|
---------+ CRY-10.01B
|
|
|
---------+ CRY-10.01AC
|
|
|
------+ CRY-11 Cryptographic Key Archival
|
|
|
---------+ CRY-11.01B
|
|
|
------+ CRY-12 Cryptographic Key Transition Management
|
|
|
---------+ CRY-12.01B
|
|
|
------+ CRY-13 Handling of Compromised Keys
|
|
|
---------+ CRY-13.01B
|
|
|
---------+ CRY-13.02B
|
|
|
------+ CRY-14 Secure Deactivation of Cryptographic Keys
|
|
|
---------+ CRY-14.01B
|
|
|
------+ CRY-15 Requirements for Pre-Shared Keys
|
|
|
---------+ CRY-15.01B
|
|
|
------+ CRY-16 Operational Continuity for Key Management
|
|
|
---------+ CRY-16.01B
|
|
|
---------+ CRY-16.02B
|
|
|
------+ CRY-17 Cryptographic Key Lifecycle Management
|
|
|
---------+ CRY-17.01B
|
|
|
---------+ CRY-17.02B
|
|
|
------+ CRY-18 Usage of External Key Management Systems
|
|
|
---------+ CRY-18.01B
|
|
|
---------+ CRY-18 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ CRY-19 Secure Handling of Customer Managed Keys
|
|
|
---------+ CRY-19.01B
|
|
|
---------+ CRY-19 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Procurement, Development and Modification of Information Systems (DEV)
|
|
|
------+ DEV-01 Policies for the Development/Procurement of System Components
|
|
|
---------+ DEV-01.01B
|
|
|
---------+ DEV-01.02B
|
|
|
---------+ DEV-01.03B
|
|
|
---------+ DEV-01.01AC
|
|
|
------+ DEV-02 Outsourcing of the Development
|
|
|
---------+ DEV-02.01B
|
|
|
---------+ DEV-02.02B
|
|
|
---------+ DEV-02.01AC
|
|
|
---------+ DEV-02.02AC
|
|
|
------+ DEV-03 Policies for Changes to System Components
|
|
|
---------+ DEV-03.01B
|
|
|
------+ DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools
|
|
|
---------+ DEV-04.01B
|
|
|
---------+ DEV-04.02B
|
|
|
------+ DEV-05 Design Documentation for Security Features
|
|
|
---------+ DEV-05.01B
|
|
|
------+ DEV-06 Risk Assessment, Categorisation and Prioritisation of Changes
|
|
|
---------+ DEV-06.01B
|
|
|
---------+ DEV-06.02B
|
|
|
---------+ DEV-06.01AC
|
|
|
------+ DEV-07 Testing Changes
|
|
|
---------+ DEV-07.01B
|
|
|
---------+ DEV-07.02B
|
|
|
---------+ DEV-07.03B
|
|
|
---------+ DEV-07.04B
|
|
|
---------+ DEV-07.05B
|
|
|
---------+ DEV-07.01AC
|
|
|
---------+ DEV-07 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ DEV-08 Logging of Changes
|
|
|
---------+ DEV-08.01B
|
|
|
---------+ DEV-08.02B
|
|
|
---------+ DEV-08.01AC
|
|
|
------+ DEV-09 Version Control
|
|
|
---------+ DEV-09.01B
|
|
|
---------+ DEV-09.02B
|
|
|
---------+ DEV-09.03B
|
|
|
---------+ DEV-09.01AC
|
|
|
---------+ DEV-09.02AC
|
|
|
------+ DEV-10 Approvals for Provision in the Production Environment
|
|
|
---------+ DEV-10.01B
|
|
|
---------+ DEV-10.02B
|
|
|
---------+ DEV-10.01AC
|
|
|
---------+ DEV-10 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ DEV-11 Protection of Development and Test Environments
|
|
|
---------+ DEV-11.01B
|
|
|
------+ DEV-12 Separation of Environments
|
|
|
---------+ DEV-12.01B
|
|
|
---------+ DEV-12.02B
|
|
|
------+ DEV-13 Transparency about Software Components
|
|
|
---------+ DEV-13.01B
|
|
|
---------+ DEV-13.02B
|
|
|
------+ DEV-14 Secure Use of Third Party Hardware and Software
|
|
|
---------+ DEV-14.01B
|
|
|
---------+ DEV-14.02B
|
|
|
---------+ DEV-14.03B
|
|
|
---------+ DEV-14.01AC
|
|
|
------+ DEV-15 Exceptions to the Change Management Process
|
|
|
---------+ DEV-15.01B
|
|
|
---+ Information on the General Conditions of the Cloud Service
|
|
|
------+ GC-01 Information on applicable law, jurisdiction, countries, partitions, regions, zones and locations
|
|
|
------+ GC-02 Information on availability and incident handling during regular operation
|
|
|
------+ GC-03 Information on recovery parameters in emergency operation
|
|
|
------+ GC-04 Information on the approach to ensuring service availability
|
|
|
------+ GC-05 Information on how investigation requests from government agencies are handled
|
|
|
------+ GC-06 Information on certifications or attestations
|
|
|
---+ Personnel (HR)
|
|
|
------+ HR-01 Verification of Qualification and Trustworthiness
|
|
|
---------+ HR-01.01B
|
|
|
---------+ HR-01.02B
|
|
|
---------+ HR-01.03B
|
|
|
---------+ HR-01.04B
|
|
|
---------+ HR-01.05B
|
|
|
---------+ HR-01.06B
|
|
|
---------+ HR-01.01AC
|
|
|
------+ HR-02 Employment Terms and Conditions
|
|
|
---------+ HR-02.01B
|
|
|
---------+ HR-02.02B
|
|
|
---------+ HR-02.03B
|
|
|
---------+ HR-02.04B
|
|
|
---------+ HR-02.05B
|
|
|
------+ HR-03 Security Training and Awareness Programme
|
|
|
---------+ HR-03.01B
|
|
|
---------+ HR-03.02B
|
|
|
---------+ HR-03.03B
|
|
|
---------+ HR-03.04B
|
|
|
---------+ HR-03.01AC
|
|
|
---------+ HR-03.02AC
|
|
|
---------+ HR-03.03AC
|
|
|
---------+ HR-03.04AC
|
|
|
---------+ HR-03.05AC
|
|
|
---------+ HR-03.02AS
|
|
|
------+ HR-04 Disciplinary Measures
|
|
|
---------+ HR-04.01B
|
|
|
---------+ HR-04.02B
|
|
|
---------+ HR-04.03B
|
|
|
---------+ HR-04.04B
|
|
|
------+ HR-05 Responsibilities in the Event of Termination or Change of Employment
|
|
|
---------+ HR-05.01B
|
|
|
------+ HR-06 Non-disclosure Agreements
|
|
|
---------+ HR-06.01B
|
|
|
---------+ HR-06.02B
|
|
|
---------+ HR-06.03B
|
|
|
---------+ HR-06.04B
|
|
|
---------+ HR-06.05B
|
|
|
---------+ HR-06.06B
|
|
|
------+ HR-07 Remote Working - Policy
|
|
|
---------+ HR-07.01B
|
|
|
------+ HR-08 Remote Working - Implementation
|
|
|
---------+ HR-08.01B
|
|
|
---+ Identity and Access Management (IAM)
|
|
|
------+ IAM-01 Policy for Identities and Access Rights
|
|
|
---------+ IAM-01.01B
|
|
|
---------+ IAM-01.02B
|
|
|
---------+ IAM-01.03B
|
|
|
---------+ IAM-01.01AC
|
|
|
------+ IAM-02 Granting and Change of Identities and Access Rights
|
|
|
---------+ IAM-02.01B
|
|
|
---------+ IAM-02.02B
|
|
|
---------+ IAM-02.03B
|
|
|
------+ IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities
|
|
|
---------+ IAM-03.01B
|
|
|
---------+ IAM-03.02B
|
|
|
---------+ IAM-03.03B
|
|
|
---------+ IAM-03.04B
|
|
|
---------+ IAM-03.01AC
|
|
|
---------+ IAM-03.02AC
|
|
|
---------+ IAM-03.03AC
|
|
|
---------+ IAM-03.03AS
|
|
|
------+ IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes
|
|
|
---------+ IAM-04.01B
|
|
|
---------+ IAM-04.02B
|
|
|
---------+ IAM-04.03B
|
|
|
---------+ IAM-04.04B
|
|
|
---------+ IAM-04.05B
|
|
|
------+ IAM-05 Regular Review of Access Rights
|
|
|
---------+ IAM-05.01B
|
|
|
---------+ IAM-05.02B
|
|
|
---------+ IAM-05.03B
|
|
|
---------+ IAM-05.04B
|
|
|
---------+ IAM-05.05B
|
|
|
---------+ IAM-05.01AC
|
|
|
------+ IAM-06 Privileged Access Rights
|
|
|
---------+ IAM-06.01B
|
|
|
---------+ IAM-06.02B
|
|
|
---------+ IAM-06.03B
|
|
|
---------+ IAM-06.04B
|
|
|
---------+ IAM-06.05B
|
|
|
---------+ IAM-06.06B
|
|
|
---------+ IAM-06.07B
|
|
|
---------+ IAM-06.08B
|
|
|
---------+ IAM-06.09B
|
|
|
---------+ IAM-06.01AC
|
|
|
---------+ IAM-06.02AC
|
|
|
---------+ IAM-06.03AC
|
|
|
---------+ IAM-06.04AC
|
|
|
------+ IAM-07 Access to Cloud Service Customer Data
|
|
|
---------+ IAM-07.01B
|
|
|
---------+ IAM-07.02B
|
|
|
---------+ IAM-07.03B
|
|
|
---------+ IAM-07.04B
|
|
|
---------+ IAM-07.05B
|
|
|
---------+ IAM-07.06B
|
|
|
---------+ IAM-07.01AC
|
|
|
---------+ IAM-07.02AC
|
|
|
---------+ IAM-07.03AC
|
|
|
---------+ IAM-07.04AC
|
|
|
---------+ IAM-07.03AS
|
|
|
---------+ IAM-07.04AS
|
|
|
---------+ IAM-07.06AS
|
|
|
---------+ IAM-07 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ IAM-08 Authentication Mechanisms
|
|
|
---------+ IAM-08.01B
|
|
|
---------+ IAM-08.02B
|
|
|
---------+ IAM-08.03B
|
|
|
---------+ IAM-08.04B
|
|
|
---------+ IAM-08.05B
|
|
|
---------+ IAM-08.06B
|
|
|
---------+ IAM-08.07B
|
|
|
---------+ IAM-08.02AS
|
|
|
---------+ IAM-08.03AS
|
|
|
------+ IAM-09 Confidentiality of Authentication Information
|
|
|
---------+ IAM-09.01B
|
|
|
---------+ IAM-09.02B
|
|
|
---------+ IAM-09.03B
|
|
|
---------+ IAM-09.04B
|
|
|
---------+ IAM-09.05B
|
|
|
---------+ IAM-09.06B
|
|
|
---------+ IAM-09.07B
|
|
|
---------+ IAM-09.01AC
|
|
|
---+ Dealing with Investigation Requests from Government Agencies (INQ)
|
|
|
------+ INQ-01 Legal Assessment of Investigation Requests
|
|
|
---------+ INQ-01.01B
|
|
|
---------+ INQ-01.02B
|
|
|
---------+ INQ-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ INQ-02 Informing Cloud Service Customers about Investigation Requests
|
|
|
---------+ INQ-02.01B
|
|
|
---------+ INQ-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ INQ-03 Limiting Access to or Disclosure of Data in Investigation Requests
|
|
|
---------+ INQ-03.01B
|
|
|
---------+ INQ-03.02B
|
|
|
---------+ INQ-03.01AC
|
|
|
---------+ INQ-03.02AC
|
|
|
------+ INQ-04 Communication of Technical Procedures for Data Disclosure in Investigation Requests
|
|
|
---------+ INQ-04.01B
|
|
|
---------+ INQ-04.02B
|
|
|
---------+ INQ-04.03B
|
|
|
---------+ INQ-04 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Organisation of Information Security (OIS)
|
|
|
------+ OIS-01 Information Security Management System (ISMS)
|
|
|
---------+ OIS-01.01B
|
|
|
---------+ OIS-01.02B
|
|
|
---------+ OIS-01.03B
|
|
|
---------+ OIS-01.01AC
|
|
|
---------+ OIS-01.01AS
|
|
|
------+ OIS-02 Information Security Policy
|
|
|
---------+ OIS-02.01B
|
|
|
---------+ OIS-02.02B
|
|
|
---------+ OIS-02.03B
|
|
|
------+ OIS-03 Interfaces and Dependencies
|
|
|
---------+ OIS-03.01B
|
|
|
---------+ OIS-03.02B
|
|
|
---------+ OIS-03.03B
|
|
|
---------+ OIS-03.04B
|
|
|
---------+ OIS-03.05B
|
|
|
---------+ OIS-03 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OIS-04 Segregation of Duties
|
|
|
---------+ OIS-04.01B
|
|
|
---------+ OIS-04.02B
|
|
|
---------+ OIS-04.03B
|
|
|
---------+ OIS-04.04B
|
|
|
---------+ OIS-04.01AC
|
|
|
---------+ OIS-04.02AC
|
|
|
------+ OIS-05 Threat Intelligence
|
|
|
---------+ OIS-05.01B
|
|
|
---------+ OIS-05.02B
|
|
|
---------+ OIS-05.03B
|
|
|
------+ OIS-06 Contact with Relevant Government Agencies and Interest Groups
|
|
|
---------+ OIS-06.01B
|
|
|
------+ OIS-07 Risk Management Policy
|
|
|
---------+ OIS-07.01B
|
|
|
------+ OIS-08 Application of the Risk Management Policy - Risk Assessment
|
|
|
---------+ OIS-08.01B
|
|
|
---------+ OIS-08.02B
|
|
|
---------+ OIS-08.03B
|
|
|
---------+ OIS-08.04B
|
|
|
---------+ OIS-08.05B
|
|
|
---------+ OIS-08.06B
|
|
|
---------+ OIS-08.01AC
|
|
|
---------+ OIS-08.02AC
|
|
|
---------+ OIS-08.01AS
|
|
|
------+ OIS-09 Application of the Risk Management Policy - Risk Treatment
|
|
|
---------+ OIS-09.01B
|
|
|
---------+ OIS-09.02B
|
|
|
---------+ OIS-09.03B
|
|
|
---------+ OIS-09.04B
|
|
|
---------+ OIS-09.05B
|
|
|
---------+ OIS-09.06B
|
|
|
---------+ OIS-09.07B
|
|
|
------+ OIS-10 Information Security in Project Management
|
|
|
---------+ OIS-10.01B
|
|
|
---+ Operations (OPS)
|
|
|
------+ OPS-01 Capacity Management - Planning
|
|
|
---------+ OPS-01.01B
|
|
|
---------+ OPS-01.02B
|
|
|
---------+ OPS-01.03B
|
|
|
---------+ OPS-01.01AC
|
|
|
---------+ OPS-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-02 Capacity Management - Monitoring
|
|
|
---------+ OPS-02.01B
|
|
|
---------+ OPS-02.02B
|
|
|
---------+ OPS-02.01AC
|
|
|
---------+ OPS-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-03 Capacity Management - Controlling of Resources
|
|
|
---------+ OPS-03.01B
|
|
|
---------+ OPS-03.02B
|
|
|
---------+ OPS-03 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-04 Protection Against Malware - Policies and Procedures
|
|
|
---------+ OPS-04.01B
|
|
|
------+ OPS-05 Protection Against Malware - Implementation
|
|
|
---------+ OPS-05.01B
|
|
|
---------+ OPS-05.02B
|
|
|
---------+ OPS-05.03B
|
|
|
---------+ OPS-05.01AC
|
|
|
---------+ OPS-05.02AC
|
|
|
---------+ OPS-05.03AC
|
|
|
---------+ OPS-05.02AS
|
|
|
---------+ OPS-05 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-06 Data Backup and Recovery - Policies and Procedures
|
|
|
---------+ OPS-06.01B
|
|
|
---------+ OPS-06.01AS
|
|
|
---------+ OPS-06 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-07 Data Backup and Recovery - Monitoring
|
|
|
---------+ OPS-07.01B
|
|
|
---------+ OPS-07.02B
|
|
|
---------+ OPS-07.01AC
|
|
|
---------+ OPS-07 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-08 Data Backup and Recovery - Regular Testing
|
|
|
---------+ OPS-08.01B
|
|
|
---------+ OPS-08.02B
|
|
|
---------+ OPS-08.03B
|
|
|
---------+ OPS-08.04B
|
|
|
---------+ OPS-08.05B
|
|
|
---------+ OPS-08.01AC
|
|
|
---------+ OPS-08.02AC
|
|
|
---------+ OPS-08 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-09 Data Backup and Recovery - Storage
|
|
|
---------+ OPS-09.01B
|
|
|
---------+ OPS-09.02B
|
|
|
---------+ OPS-09.03B
|
|
|
---------+ OPS-09.04B
|
|
|
---------+ OPS-09.05B
|
|
|
------+ OPS-10 Logging and Monitoring - Policies and Procedures
|
|
|
---------+ OPS-10.01B
|
|
|
---------+ OPS-10 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-11 Logging and Monitoring - Policies and Procedures for Handling Cloud Service Derived Data and Account Data
|
|
|
---------+ OPS-11.01B
|
|
|
---------+ OPS-11.02B
|
|
|
---------+ OPS-11.01AC
|
|
|
---------+ OPS-11.02AC
|
|
|
---------+ OPS-11 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-12 Logging and Monitoring - Access, Retention and Deletion
|
|
|
---------+ OPS-12.01B
|
|
|
------+ OPS-13 Logging and Monitoring - Security Information and Event Management
|
|
|
---------+ OPS-13.01B
|
|
|
---------+ OPS-13.02B
|
|
|
---------+ OPS-13.01AC
|
|
|
---------+ OPS-13.02AC
|
|
|
---------+ OPS-13.03AC
|
|
|
------+ OPS-14 Logging and Monitoring - Retention of the Logging Data
|
|
|
---------+ OPS-14.01B
|
|
|
---------+ OPS-14.02B
|
|
|
---------+ OPS-14.03B
|
|
|
---------+ OPS-14 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-15 Logging and Monitoring - Accountability
|
|
|
---------+ OPS-15.01B
|
|
|
---------+ OPS-15.02B
|
|
|
---------+ OPS-15.03B
|
|
|
---------+ OPS-15.01AC
|
|
|
---------+ OPS-15.02AC
|
|
|
---------+ OPS-15 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-16 Logging and Monitoring - Configuration
|
|
|
---------+ OPS-16.01B
|
|
|
---------+ OPS-16.02B
|
|
|
------+ OPS-17 Logging and Monitoring - Availability of the Monitoring Software
|
|
|
---------+ OPS-17.01B
|
|
|
---------+ OPS-17.02B
|
|
|
---------+ OPS-17.01AC
|
|
|
---------+ OPS-17.02AC
|
|
|
------+ OPS-18 Managing Vulnerabilities - Policies and Procedures
|
|
|
---------+ OPS-18.01B
|
|
|
---------+ OPS-18.02B
|
|
|
---------+ OPS-18.03B
|
|
|
---------+ OPS-18.04B
|
|
|
---------+ OPS-18.05B
|
|
|
---------+ OPS-18 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-19 Managing Incidents and Crashes - Policies and Procedures
|
|
|
---------+ OPS-19.01B
|
|
|
------+ OPS-20 Managing Incidents - Implementation
|
|
|
---------+ OPS-20.01B
|
|
|
------+ OPS-21 Managing Crashes - Implementation
|
|
|
---------+ OPS-21.01B
|
|
|
------+ OPS-22 Managing Vulnerabilities, Incidents and Crashes - Penetration Tests
|
|
|
---------+ OPS-22.01B
|
|
|
---------+ OPS-22.02B
|
|
|
---------+ OPS-22.03B
|
|
|
---------+ OPS-22.04B
|
|
|
---------+ OPS-22.05B
|
|
|
---------+ OPS-22.06B
|
|
|
---------+ OPS-22.07B
|
|
|
---------+ OPS-22.08B
|
|
|
---------+ OPS-22.01AC
|
|
|
---------+ OPS-22.02AC
|
|
|
---------+ OPS-22.03AC
|
|
|
---------+ OPS-22.04AC
|
|
|
---------+ OPS-22.05AC
|
|
|
---------+ OPS-22.01AS
|
|
|
---------+ OPS-22.02AS
|
|
|
---------+ OPS-22.03AS
|
|
|
------+ OPS-23 Managing Vulnerabilities, Incidents and Crashes - Measurements, Analyses and Assessments of Procedures
|
|
|
---------+ OPS-23.01B
|
|
|
---------+ OPS-23.02B
|
|
|
------+ OPS-24 Involvement of Cloud Service Customers in the Event of Incidents
|
|
|
---------+ OPS-24.01B
|
|
|
---------+ OPS-24.02B
|
|
|
---------+ OPS-24.01AC
|
|
|
---------+ OPS-24 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-25 Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans
|
|
|
---------+ OPS-25.01B
|
|
|
---------+ OPS-25.02B
|
|
|
---------+ OPS-25.03B
|
|
|
---------+ OPS-25.04B
|
|
|
---------+ OPS-25.01AC
|
|
|
---------+ OPS-25.01AS
|
|
|
---------+ OPS-25.02AS
|
|
|
---------+ OPS-25 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-26 Managing Vulnerabilities, Incidents and Crashes - System Hardening
|
|
|
---------+ OPS-26.01B
|
|
|
---------+ OPS-26.02B
|
|
|
---------+ OPS-26.03B
|
|
|
---------+ OPS-26.04B
|
|
|
---------+ OPS-26.05B
|
|
|
---------+ OPS-26.06B
|
|
|
---------+ OPS-26.05AS
|
|
|
---------+ OPS-26 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-27 Managing Vulnerabilities - Patch Management Policies and Procedures
|
|
|
---------+ OPS-27.01B
|
|
|
---------+ OPS-27.02B
|
|
|
---------+ OPS-27.03B
|
|
|
---------+ OPS-27.04B
|
|
|
---------+ OPS-27.03AS
|
|
|
------+ OPS-28 Managing Vulnerabilities - Patch Management Implementation
|
|
|
---------+ OPS-28.01B
|
|
|
------+ OPS-29 Managing Vulnerabilities, Incidents and Crashes - Externally Sourced Components
|
|
|
---------+ OPS-29.01B
|
|
|
------+ OPS-30 Separation of Datasets - Policies and Procedures
|
|
|
---------+ OPS-30.01B
|
|
|
------+ OPS-31 Separation of Datasets - Implementation
|
|
|
---------+ OPS-31.01B
|
|
|
---------+ OPS-31.02B
|
|
|
---------+ OPS-31.03B
|
|
|
---------+ OPS-31 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ OPS-32 Confidential Computing - Policies and Procedures
|
|
|
---------+ OPS-32.01B
|
|
|
---------+ OPS-32.02B
|
|
|
---------+ OPS-32.03B
|
|
|
---------+ OPS-32.01AC
|
|
|
------+ OPS-33 Confidential Computing - Remote Attestation
|
|
|
---------+ OPS-33.01B
|
|
|
---------+ OPS-33.02B
|
|
|
---------+ OPS-33.03B
|
|
|
---------+ OPS-33.01AC
|
|
|
---------+ OPS-33.02AC
|
|
|
------+ OPS-34 Container Management - Policies and Procedures
|
|
|
---------+ OPS-34.01B
|
|
|
---------+ OPS-34.02B
|
|
|
---------+ OPS-34.01AC
|
|
|
------+ OPS-35 Container Management - Implementation
|
|
|
---------+ OPS-35.01B
|
|
|
---+ Portability and Interoperability (PI)
|
|
|
------+ PI-01 Safety of Input and Output Interfaces
|
|
|
---------+ PI-01.01B
|
|
|
---------+ PI-01.02B
|
|
|
---------+ PI-01.01AC
|
|
|
---------+ PI-01.02AC
|
|
|
---------+ PI-01.03AC
|
|
|
---------+ PI-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PI-02 Contractual Agreements for the Provision of Data
|
|
|
---------+ PI-02.01B
|
|
|
---------+ PI-02.01AC
|
|
|
---------+ PI-02.02AC
|
|
|
---------+ PI-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PI-03 Secure Deletion of Data
|
|
|
---------+ PI-03.01B
|
|
|
---------+ PI-03.02B
|
|
|
---------+ PI-03.03B
|
|
|
---------+ PI-03 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Physical Security (PS)
|
|
|
------+ PS-01 Physical Security and Environmental Control Requirements
|
|
|
---------+ PS-01.01B
|
|
|
---------+ PS-01.02B
|
|
|
---------+ PS-01.03B
|
|
|
---------+ PS-01.04B
|
|
|
---------+ PS-01.05B
|
|
|
---------+ PS-01.06B
|
|
|
---------+ PS-01.01AC
|
|
|
---------+ PS-01.02AC
|
|
|
---------+ PS-01.03AC
|
|
|
---------+ PS-01.04AC
|
|
|
---------+ PS-01.05AC
|
|
|
------+ PS-02 Redundancy Model
|
|
|
---------+ PS-02.01B
|
|
|
---------+ PS-02.02B
|
|
|
---------+ PS-02.03B
|
|
|
---------+ PS-02.01AS
|
|
|
---------+ PS-02.02AS
|
|
|
---------+ PS-02 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PS-03 Perimeter Protection
|
|
|
---------+ PS-03.01B
|
|
|
---------+ PS-03.02B
|
|
|
---------+ PS-03.03B
|
|
|
---------+ PS-03.04B
|
|
|
---------+ PS-03.05B
|
|
|
---------+ PS-03.06B
|
|
|
---------+ PS-03.01AC
|
|
|
------+ PS-04 Physical Site Access Control
|
|
|
---------+ PS-04.01B
|
|
|
---------+ PS-04.02B
|
|
|
---------+ PS-04.03B
|
|
|
------+ PS-05 Protection against Threats from Outside and from the Environment
|
|
|
---------+ PS-05.01B
|
|
|
---------+ PS-05.02B
|
|
|
---------+ PS-05.03B
|
|
|
---------+ PS-05.04B
|
|
|
------+ PS-06 Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities
|
|
|
---------+ PS-06.01B
|
|
|
---------+ PS-06.02B
|
|
|
---------+ PS-06.03B
|
|
|
---------+ PS-06.01AC
|
|
|
---------+ PS-06.02AC
|
|
|
---------+ PS-06.03AC
|
|
|
---------+ PS-06.04AC
|
|
|
------+ PS-07 Surveillance of Operational and Environmental Parameters
|
|
|
---------+ PS-07.01B
|
|
|
---------+ PS-07.02B
|
|
|
------+ PS-08 Workplace Security Requirements
|
|
|
---------+ PS-08.01B
|
|
|
---+ Product Safety and Security (PSS)
|
|
|
------+ PSS-01 Guidelines and Recommendations for Cloud Service Customers
|
|
|
---------+ PSS-01.01B
|
|
|
---------+ PSS-01.02B
|
|
|
---------+ PSS-01.03B
|
|
|
---------+ PSS-01.04B
|
|
|
---------+ PSS-01.01AC
|
|
|
---------+ PSS-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-02 Identification of Vulnerabilities of the Cloud Service
|
|
|
---------+ PSS-02.01B
|
|
|
---------+ PSS-02.02B
|
|
|
---------+ PSS-02.03B
|
|
|
---------+ PSS-02.01AC
|
|
|
------+ PSS-03 Informing Customers about Known Vulnerabilities
|
|
|
---------+ PSS-03.01B
|
|
|
---------+ PSS-03.02B
|
|
|
---------+ PSS-03.03B
|
|
|
---------+ PSS-03.04B
|
|
|
---------+ PSS-03.05B
|
|
|
---------+ PSS-03.01AC
|
|
|
---------+ PSS-03.02AC
|
|
|
---------+ PSS-03 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-04 Error handling and Logging Mechanisms
|
|
|
---------+ PSS-04.01B
|
|
|
---------+ PSS-04.02B
|
|
|
---------+ PSS-04.03B
|
|
|
---------+ PSS-04.04B
|
|
|
---------+ PSS-04.05B
|
|
|
---------+ PSS-04.06B
|
|
|
---------+ PSS-04.01AC
|
|
|
---------+ PSS-04 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-05 Authentication Mechanisms
|
|
|
---------+ PSS-05.01B
|
|
|
---------+ PSS-05.02B
|
|
|
---------+ PSS-05.01AC
|
|
|
---------+ PSS-05 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-06 Session Management
|
|
|
---------+ PSS-06.01B
|
|
|
---------+ PSS-06.02B
|
|
|
---------+ PSS-06 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-07 Confidentiality of Authentication Information
|
|
|
---------+ PSS-07.01B
|
|
|
---------+ PSS-07.02B
|
|
|
---------+ PSS-07.03B
|
|
|
---------+ PSS-07 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-08 Roles and Rights Framework
|
|
|
---------+ PSS-08.01B
|
|
|
---------+ PSS-08.02B
|
|
|
---------+ PSS-08.03B
|
|
|
---------+ PSS-08.04B
|
|
|
---------+ PSS-08 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-09 Authorisation Mechanisms
|
|
|
---------+ PSS-09.01B
|
|
|
---------+ PSS-09.02B
|
|
|
---------+ PSS-09.03B
|
|
|
---------+ PSS-09.01AC
|
|
|
---------+ PSS-09 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-10 Software Defined Networking
|
|
|
---------+ PSS-10.01B
|
|
|
---------+ PSS-10.02B
|
|
|
---------+ PSS-10 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-11 Images for Virtual Machines and Containers
|
|
|
---------+ PSS-11.01B
|
|
|
---------+ PSS-11.01AC
|
|
|
---------+ PSS-11.02AC
|
|
|
---------+ PSS-11 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ PSS-12 Region of Data Processing and Storage
|
|
|
---------+ PSS-12.01B
|
|
|
---------+ PSS-12.02B
|
|
|
---------+ PSS-12.03B
|
|
|
---------+ PSS-12.04B
|
|
|
---------+ PSS-12.01AC
|
|
|
---------+ PSS-12.02AC
|
|
|
---------+ PSS-12.01AS
|
|
|
---------+ PSS-12.02AS
|
|
|
---------+ PSS-12 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Security Incident Management (SIM)
|
|
|
------+ SIM-01 Policy for Security Incident Management
|
|
|
---------+ SIM-01.01B
|
|
|
---------+ SIM-01.02B
|
|
|
---------+ SIM-01.03B
|
|
|
---------+ SIM-01.04B
|
|
|
---------+ SIM-01 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ SIM-02 Security Incident Response Plans
|
|
|
---------+ SIM-02.01B
|
|
|
---------+ SIM-02.02B
|
|
|
------+ SIM-03 Processing of Security Incidents
|
|
|
---------+ SIM-03.01B
|
|
|
---------+ SIM-03.02B
|
|
|
---------+ SIM-03.03B
|
|
|
---------+ SIM-03.04B
|
|
|
---------+ SIM-03.05B
|
|
|
---------+ SIM-03.06B
|
|
|
---------+ SIM-03.07B
|
|
|
---------+ SIM-03.01AC
|
|
|
---------+ SIM-03.02AC
|
|
|
---------+ SIM-03.03AC
|
|
|
------+ SIM-04 Documentation and Reporting of Security Incidents
|
|
|
---------+ SIM-04.01B
|
|
|
---------+ SIM-04.02B
|
|
|
---------+ SIM-04.01AC
|
|
|
---------+ SIM-04.02AC
|
|
|
---------+ SIM-04 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body
|
|
|
---------+ SIM-05.01B
|
|
|
---------+ SIM-05.02B
|
|
|
---------+ SIM-05.03B
|
|
|
---------+ SIM-05 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ SIM-06 Evaluation and Learning Process
|
|
|
---------+ SIM-06.01B
|
|
|
---------+ SIM-06.02B
|
|
|
---------+ SIM-06.03B
|
|
|
---------+ SIM-06.04B
|
|
|
---------+ SIM-06 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Security Policies and Procedures (SP)
|
|
|
------+ SP-01 Documentation, Communication and Provision of Policies and Procedures
|
|
|
---------+ SP-01.01B
|
|
|
---------+ SP-01.02B
|
|
|
---------+ SP-01.03B
|
|
|
---------+ SP-01.04B
|
|
|
------+ SP-02 Review and Approval of Policies and Procedures
|
|
|
---------+ SP-02.01B
|
|
|
---------+ SP-02.02B
|
|
|
------+ SP-03 Exceptions from Existing Policies and Procedures
|
|
|
---------+ SP-03.01B
|
|
|
---------+ SP-03.02B
|
|
|
---------+ SP-03.03B
|
|
|
---------+ SP-03.04B
|
|
|
---------+ SP-03.05B
|
|
|
---------+ SP-03.01AC
|
|
|
---------+ SP-03.02AC
|
|
|
---------+ SP-03.03AC
|
|
|
---------+ SP-03 Supplementary Information - Complementary Customer Criteria
|
|
|
---+ Control and Monitoring of Service Providers and Suppliers (SSO)
|
|
|
------+ SSO-01 Policies and Procedures for Controlling and Monitoring Service Organisations
|
|
|
---------+ SSO-01.01B
|
|
|
---------+ SSO-01.01AC
|
|
|
---------+ SSO-01.02AC
|
|
|
------+ SSO-02 Risk Assessment of Service Organisations
|
|
|
---------+ SSO-02.01B
|
|
|
---------+ SSO-02.02B
|
|
|
------+ SSO-03 Data Processing of Service Organisations
|
|
|
---------+ SSO-03.01B
|
|
|
---------+ SSO-03.02B
|
|
|
---------+ SSO-03.01AS
|
|
|
------+ SSO-04 Directory of Service Organisations
|
|
|
---------+ SSO-04.01B
|
|
|
---------+ SSO-04.02B
|
|
|
------+ SSO-05 Monitoring of Compliance with Requirements
|
|
|
---------+ SSO-05.01B
|
|
|
---------+ SSO-05.02B
|
|
|
---------+ SSO-05.03B
|
|
|
---------+ SSO-05.04B
|
|
|
---------+ SSO-05.05B
|
|
|
---------+ SSO-05.06B
|
|
|
---------+ SSO-05.07B
|
|
|
---------+ SSO-05.01AC
|
|
|
---------+ SSO-05.02AC
|
|
|
---------+ SSO-05.03AC
|
|
|
---------+ SSO-05 Supplementary Information - Complementary Customer Criteria
|
|
|
------+ SSO-06 Contract Termination Strategy for Service Organisations
|
|
|
---------+ SSO-06.01B
|
|
|
---------+ SSO-06.02B
|
|
|
------+ SSO-07 Ensuring Transparency within Service Organisations
|
|
|
---------+ SSO-07.01B
|
|
|
---------+ SSO-07.02B
|
|
|
---------+ SSO-07.01AS
|
|
|
------+ SSO-08 Controlling Exchanges with Suppliers of Functional Components
|
|
|
---------+ SSO-08.01B
|
|
|
---------+ SSO-08.02B
|
|
|
---------+ SSO-08.03B
|
|
Criteria enabling Cloud Computing Autonomy (C3A)
IT-Grundschutz-Compendium
Ärenden
| Rubrik |
Källa |
|
+ IT-Grundschutz-Compendium
|
|
|
---+ G 0.1 Fire
|
|
|
---+ G 0.2 Unfavourable Climatic Conditions
|
|
|
---+ G 0.3 Water
|
|
|
---+ G 0.4 Pollution, Dust, Corrosion
|
|
|
---+ G 0.5 Natural Disasters
|
|
|
---+ G 0.6 Catastrophes in the Vicinity
|
|
|
---+ G 0.7 Major Events in the Vicinity
|
|
|
---+ G 0.8 Failure or Disruption of the Power Supply
|
|
|
---+ G 0.9 Failure or Disruption of Communication Networks
|
|
|
---+ G 0.10 Failure or Disruption of Supply Networks
|
|
|
---+ G 0.11 Failure or Disruption of Service Providers
|
|
|
---+ G 0.12 Electromagnetic Interference
|
|
|
---+ G 0.13 Interception of Compromising Interference Signals
|
|
|
---+ G 0.14 Interception of Information / Espionage
|
|
|
---+ G 0.15 Eavesdropping
|
|
|
---+ G 0.16 Theft of Devices, Storage Media and Documents
|
|
|
---+ G 0.17 Loss of Devices, Storage Media and Documents
|
|
|
---+ G 0.18 Poor Planning or Lack of Adaptation
|
|
|
---+ G 0.19 Disclosure of Sensitive Information
|
|
|
---+ G 0.20 Information or Products from an Unreliable Source
|
|
|
---+ G 0.21 Manipulation with Hardware or Software
|
|
|
---+ G 0.22 Manipulation of Information
|
|
|
---+ G 0.23 Unauthorised Access to IT Systems
|
|
|
---+ G 0.24 Destruction of Devices or Storage Media
|
|
|
---+ G 0.25 Failure of Devices or Systems
|
|
|
---+ G 0.26 Malfunction of Devices or Systems
|
|
|
---+ G 0.27 Lack of Resources
|
|
|
---+ G 0.28 Software Vulnerabilities or Errors
|
|
|
---+ G 0.29 Violations of Laws or Regulations
|
|
|
---+ G 0.30 Unauthorised Use or Administration of Devices and Systems
|
|
|
---+ G 0.31 Incorrect Use or Administration of Devices and Systems
|
|
|
---+ G 0.32 Misuse of Authorisation
|
|
|
---+ G 0.33 Shortage of Personnel
|
|
|
---+ G 0.34 Assault
|
|
|
---+ G 0.35 Coercion, Blackmail or Corruption
|
|
|
---+ G 0.36 Identity theft
|
|
|
---+ G 0.37 Repudiation of Actions
|
|
|
---+ G 0.38 Misuse of Personal Information
|
|
|
---+ G 0.39 Malware
|
|
|
---+ G 0.40 Denial of Service
|
|
|
---+ G 0.41 Sabotage
|
|
|
---+ G 0.42 Social Engineering
|
|
|
---+ G 0.43 Attack with Specially Crafted Messages
|
|
|
---+ G 0.44 Unauthorised Entry to Premises
|
|
|
---+ G 0.45 Data Loss
|
|
|
---+ G 0.46 Loss of Integrity of Sensitive Information
|
|
|
---+ G 0.47 Harmful Side Effects of IT-Supported Attacks
|
|
|
---+ Security Management
|
|
|
------+ ISMS.1 Security Management
|
|
|
---------+ ISMS.1.G1. Lack of Personal Responsibility in the Security Process
|
|
|
---------+ ISMS.1.G2. Lack of Support from Top Management
|
|
|
---------+ ISMS.1.G3. Inadequate Strategic and Conceptual Specifications
|
|
|
---------+ ISMS.1.G4. Inadequate or Misdirected Investments
|
|
|
---------+ ISMS.1.G5. Inadequate Enforcement of Security Safeguards
|
|
|
---------+ ISMS.1.G6. Failure to Update the Security Process
|
|
|
---------+ ISMS.1.G7. Violation of Statutory Regulations and Contractual Agreements
|
|
|
---------+ ISMS.1.G8. Business Process Disruptions due to Security Incidents
|
|
|
---------+ ISMS.1.G9. Uneconomical Use of Resources due to Inadequate Security Management
|
|
|
---------+ ISMS.1.A1 Acceptance of Overall Responsibility for Information Security by Top Management [Top Management] (B)
|
|
|
---------+ ISMS.1.A2 Defining Security Objectives and Strategy [Top Management] (B)
|
|
|
---------+ ISMS.1.A3 Drawing Up an Information Security Policy [Top Management] (B)
|
|
|
---------+ ISMS.1.A4 Appointment of a Chief Information Security Officer [Top Management] (B)
|
|
|
---------+ ISMS.1.A5 Contract Design When Appointing an External Chief Information Security Officer [Top Management] (B)
|
|
|
---------+ ISMS.1.A6 Establishment of a Suitable Organisational Structure for Information Security [Top Management] (B)
|
|
|
---------+ ISMS.1.A7 Definition of Security Safeguards (B)
|
|
|
---------+ ISMS.1.A8 Integration of Employees into the Security Process [Supervisor] (B)
|
|
|
---------+ ISMS.1.A9 Integrating Information Security into Organisation-Wide Procedures and Processes [Top Management] (B)
|
|
|
---------+ ISMS.1.A10 Drawing Up a Security Concept (S)
|
|
|
---------+ ISMS.1.A11 Continuity of Information Security (S)
|
|
|
---------+ ISMS.1.A12 Management Reports on Information Security [Top Management] (S)
|
|
|
---------+ ISMS.1.A13 Documentation of the Security Process (S)
|
|
|
---------+ ISMS.1.A15 Cost-Effective Use of Resources for Information Security (S)
|
|
|
---------+ ISMS.1.A16 Creating Target-Group-Orientated Security Policies (H)
|
|
|
---------+ ISMS.1.A17 Taking Out Insurance (H)
|
|
|
---+ Organisation and Personnel
|
|
|
------+ ORP.1 Organisation
|
|
|
---------+ ORP.1.G1. Insufficient Rules
|
|
|
---------+ ORP.1.G2. Non-Compliance with Regulations
|
|
|
---------+ ORP.1.G3. Inadequate or Incompatible Resources
|
|
|
---------+ ORP.1.G4. Threats from Outside the Organisation
|
|
|
---------+ ORP.1.A1 Specification of Responsibilities and Provisions [Top Management]
|
|
|
---------+ ORP.1.A2 Assigning Responsibilities [Top Management] (B)
|
|
|
---------+ ORP.1.A3 Supervising or Escorting External Individuals [Employee] (B)
|
|
|
---------+ ORP.1.A4 Separation of Roles Between Incompatible Tasks (B)
|
|
|
---------+ ORP.1.A15 Contact Persons for Information Security Issues (B)
|
|
|
---------+ ORP.1.A8 Managing Resources and Devices [IT Operation Department] (S)
|
|
|
---------+ ORP.1.A13 Security During Relocation [IT Operation Department, Building Services] (S)
|
|
|
---------+ ORP.1.A16 Policy for Secure IT Use [User] (S)
|
|
|
------+ ORP.2 Personnel
|
|
|
---------+ ORP.2.G1. Shortage of Personnel
|
|
|
---------+ ORP.2.G2. Insufficient Knowledge of Rules and Procedures
|
|
|
---------+ ORP.2.G3. Carelessness in Handling Information
|
|
|
---------+ ORP.2.G4. Insufficient Employee Qualifications
|
|
|
---------+ ORP.2.A1 Well-Regulated Orientation of New Employees [Supervisor] (B)
|
|
|
---------+ ORP.2.A2 Regulated Procedure for Employees Leaving the Organisation [Supervisor, IT Operation Department] (B)
|
|
|
---------+ ORP.2.A3 Defining Deputising Rules [Supervisor] (B)
|
|
|
---------+ ORP.2.A4 Defining Procedures for Using Third-Party Personnel (B)
|
|
|
---------+ ORP.2.A5 Confidentiality Agreements for Third-Party Personnel (B)
|
|
|
---------+ ORP.2.A14 Tasks and Responsibilities of Employees [Supervisor] (B)
|
|
|
---------+ ORP.2.A15 Qualifications of Personnel [Supervisor] (B)
|
|
|
---------+ ORP.2.A7 Verifying the Trustworthiness of Employees (S)
|
|
|
---------+ ORP.2.A13 Security Vetting (H)
|
|
|
------+ ORP.3 Awareness and Training in Information Security
|
|
|
---------+ ORP.3.G1. Insufficient Knowledge of Rules and Procedures
|
|
|
---------+ ORP.3.G2. Insufficient Awareness of Information Security
|
|
|
---------+ ORP.3.G3. Ineffective Awareness and Training Activities
|
|
|
---------+ ORP.3.G4. Insufficient Employee Training Regarding Security Functions
|
|
|
---------+ ORP.3.G5. Undetected Security Incidents
|
|
|
---------+ ORP.3.G6. Non-Compliance with Security Safeguards
|
|
|
---------+ ORP.3.G7. Carelessness in Handling Information
|
|
|
---------+ ORP.3.G8. Lack of Acceptance of Information Security Policies
|
|
|
---------+ ORP.3.G9. Social Engineering
|
|
|
---------+ ORP.3.A1 Top Management Awareness of Information Security Issues [Supervisor, Top Management] (B)
|
|
|
---------+ ORP.3.A3 Training Employees in the Secure Handling of IT [Supervisor, Human Resources Department, IT Operation Department] (B)
|
|
|
---------+ ORP.3.A4 Designing and Planning an Information Security Awareness and Training Program (S)
|
|
|
---------+ ORP.3.A6 Implementation of Information Security Awareness and Training Measures (S)
|
|
|
---------+ ORP.3.A7 Training in the IT-Grundschutz Methodology (S)
|
|
|
---------+ ORP.3.A8 Measurement and Evaluation of Training Success [Human Resources Department] (S)
|
|
|
---------+ ORP.3.A9 Special Training for Exposed Persons and Organisations (H)
|
|
|
------+ ORP.4 Identity and Access Management
|
|
|
---------+ ORP.4.G1. Insufficient Processes in Identity and Access Management
|
|
|
---------+ ORP.4.G2. No Central Means of Disabling User Access Authorisations
|
|
|
---------+ ORP.4.G3. Incorrect Administration of Site, System, and Data Access Rights
|
|
|
---------+ ORP.4.A1 Regulation for Creating and Deleting Users and User Groups [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A2 Creating, Changing, and Revoking Authorisations [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A3 Documentation of User IDs and Rights Profiles [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A4 Distribution of Tasks and Separation of Roles [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A5 Assignment of Site Access Rights [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A6 Assignment of System Access Rights [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A7 Assignment of Data Access Rights [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A8 Provisions Governing the Use of Passwords [User, IT Operation Department] (B)
|
|
|
---------+ ORP.4.A9 Identification and Authentication [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A22 Regulating Password Quality [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A23 Regulating Password-Processing Applications and IT Systems [IT Operation Department] (B)
|
|
|
---------+ ORP.4.A10 Protection of User IDs with Wide-Ranging Authorisations [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A11 Resetting Passwords [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A12 Developing an Authentication Concept for IT Systems and Applications [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A13 Selection of Suitable Authentication Mechanisms [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A14 Checking the Effectiveness of User Separation in IT Systems or Applications [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A15 Approach and Design of Identity and Access Management Processes [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A16 Policies for Data and System Access Control [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A17 Suitable Selection of Identity and Access Management Systems [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A18 Using a Central Authentication Service [IT Operation Department] (S)
|
|
|
---------+ ORP.4.A19 Instruction of All Employees in the Handling of Authentication Methods and Mechanisms [User, Head of IT] (S)
|
|
|
---------+ ORP.4.A20 Contingency Planning for the Identity and Access Management System [IT Operation Department] (H)
|
|
|
---------+ ORP.4.A21 Multi-Factor Authentication [IT Operation Department] (H)
|
|
|
---------+ ORP.4.A24 Dual Control for Administrative Activities [IT Operation Department] (H)
|
|
|
------+ ORP.5 Compliance Management
|
|
|
---------+ ORP.5.G1. Violations of Legal Provisions
|
|
|
---------+ ORP.5.G2. Improper Forwarding of Information
|
|
|
---------+ ORP.5.G3. Inadequate Checking of the Identity of Communication Partners
|
|
|
---------+ ORP.5.G4. Accidental Sharing of Internal Information
|
|
|
---------+ ORP.5.A1 Identification of Framework Conditions [Central Administration, Top Management] (B)
|
|
|
---------+ ORP.5.A2 Compliance with Framework Conditions [Supervisor, Central Administration, Top Management] (B)
|
|
|
---------+ ORP.5.A4 Design and Organisation of Compliance Management [Top Management] (S)
|
|
|
---------+ ORP.5.A5 Granting Exceptions [Supervisor, Chief Information Security Officer (CISO)] (S)
|
|
|
---------+ ORP.5.A8 Regular Reviews of Compliance Management (S)
|
|
|
---+ Concepts and Procedures
|
|
|
------+ CON.1 Crypto Concept
|
|
|
---------+ CON.1.G1. Inadequate Key Management for Encryption
|
|
|
---------+ CON.1.G2. Violation of Legal Framework Conditions Regarding the Use of Cryptographic Methods
|
|
|
---------+ CON.1.G3. Loss of Data Confidentiality or Integrity Due to Misbehaviour
|
|
|
---------+ CON.1.G4. Software Vulnerabilities or Errors in Crypto Modules
|
|
|
---------+ CON.1.G5. Failure of a Crypto Module
|
|
|
---------+ CON.1.G6. Insecure Cryptographic Algorithms or Products
|
|
|
---------+ CON.1.G7. Errors in Encrypted Data or Cryptographic Keys
|
|
|
---------+ CON.1.G8. Unauthorised Use of a Crypto Module
|
|
|
---------+ CON.1.G9. Compromised Cryptographic Keys
|
|
|
---------+ CON.1.G10. Forged Certificates
|
|
|
---------+ CON.1.A1 Selecting Appropriate Cryptographic Methods [Process Owner]
|
|
|
---------+ CON.1.A2 Backups When Using Cryptographic Methods [IT Operation Department] (B)
|
|
|
---------+ CON.1.A3 Encryption of Communication Links (S)
|
|
|
---------+ CON.1.A4 Appropriate Key Management (S)
|
|
|
---------+ CON.1.A5 Secure Deletion and Destruction of Cryptographic Keys [IT Operation Department] (S)
|
|
|
---------+ CON.1.A6 Identifying the Need for Cryptographic Methods and Products [IT Operation Department, Process Owner] (S)
|
|
|
---------+ CON.1.A7 Drawing Up a Security Policy for the Use of Cryptographic Methods and Products (H)
|
|
|
---------+ CON.1.A8 Determining the Factors That Influence Cryptographic Methods and Products (H)
|
|
|
---------+ CON.1.A9 Selecting an Appropriate Cryptographic Product [IT Operation Department, Process Owner] (H)
|
|
|
---------+ CON.1.A10 Developing a Crypto Concept (H)
|
|
|
---------+ CON.1.A11 Secure Configuration of Crypto Modules [IT Operation Department] (H)
|
|
|
---------+ CON.1.A12 Secure Separation of Roles When Using Crypto Modules [IT Operation Department] (H)
|
|
|
---------+ CON.1.A13 Operating System Security Requirements When Using Crypto Modules (H)
|
|
|
---------+ CON.1.A14 Training of Users and Administrators [Supervisor, Process Owner, IT Operation Department] (H)
|
|
|
---------+ CON.1.A15 Reacting to the Practical Weakening of a Crypto Method (H)
|
|
|
---------+ CON.1.A16 Physical Protection of Crypto Modules [IT Operation Department] (H)
|
|
|
---------+ CON.1.A17 Emission Security [IT Operation Department] (H)
|
|
|
---------+ CON.1.A18 Cryptographic Replacement Modules [IT Operation Department] (H)
|
|
|
------+ CON.2 Data Protection
|
|
|
---------+ CON.2.G1. Non-Compliance with Data Protection Laws or Use of an Incomplete Risk Model
|
|
|
---------+ CON.2.G2. Definition of Insufficient Protection Needs
|
|
|
---------+ CON.2.A1 Implementing the German Standard Data Protection Model (B)
|
|
|
------+ CON.3 Backup Concept
|
|
|
---------+ CON.3.G1. Lack of Backups
|
|
|
---------+ CON.3.G2. Lack of Recovery Tests
|
|
|
---------+ CON.3.G3. Unsuitable Storage of Backup Media
|
|
|
---------+ CON.3.G4. Inadequate Documentation
|
|
|
---------+ CON.3.G5. Non-Compliance with Statutory Regulations
|
|
|
---------+ CON.3.G6. Using Insecure Providers for Online Backups
|
|
|
---------+ CON.3.G7. Insufficient Storage Capacity
|
|
|
---------+ CON.3.G8. Inadequate Backup Concept
|
|
|
---------+ CON.3.G9. Insufficient Data Backup Speed
|
|
|
---------+ CON.3.G10. Ransomware
|
|
|
---------+ CON.3.A1 Determining the Factors That Influence Backups [Process Owner, IT Operation Department] (B)
|
|
|
---------+ CON.3.A2 Establishment of Backup Procedures [Process Owner, IT Operation Department] (B)
|
|
|
---------+ CON.3.A4 Creating Backup Plans [IT Operation Department] (B)
|
|
|
---------+ CON.3.A5 Regular Backups [IT Operation Department] (B)
|
|
|
---------+ CON.3.A12 Secure Storage of Backup Media [IT Operation Department] (B)
|
|
|
---------+ CON.3.A14 Protection of Backups [IT Operation Department] (B)
|
|
|
---------+ CON.3.A15 Regular Backup Testing [IT Operation Department] (B)
|
|
|
---------+ CON.3.A6 Developing a Backup Concept [Process Owner, IT Operation Department] (S)
|
|
|
---------+ CON.3.A7 Procuring a Suitable Backup System [IT Operation Department] (S)
|
|
|
---------+ CON.3.A9 Prerequisites of Online Backups [IT Operation Department] (S)
|
|
|
---------+ CON.3.A13 Using Cryptographic Methods for Backups [IT Operation Department] (H)
|
|
|
------+ CON.6 Deleting and Destroying Data and Devices
|
|
|
---------+ CON.6.G1. Non-Existent or Insufficiently Documented Regulations for Deletion and Destruction
|
|
|
---------+ CON.6.G2. Loss of Confidentiality due to Residual Information on Storage Media
|
|
|
---------+ CON.6.G3. Inappropriate Involvement of External Service Providers in the Deletion and Destruction Process
|
|
|
---------+ CON.6.G4. Inappropriate Handling of Defective Storage Media or IT Devices
|
|
|
---------+ CON.6.A1 Regulations for Deleting or Destroying Information [Central Administration, Process Owner, Data Protection Officer, IT Operation Department] (B)
|
|
|
---------+ CON.6.A2 Proper Deletion and Destruction of Sensitive Resources and Information (B)
|
|
|
---------+ CON.6.A11 Deletion and Destruction of Storage Media by External Service Providers (B)
|
|
|
---------+ CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B)
|
|
|
---------+ CON.6.A4 Selecting Suitable Methods for Deleting or Destroying Storage Media (S)
|
|
|
---------+ CON.6.A8 Creating a Policy for Deleting and Destroying Information [Employee, IT Operation Department, Data Protection Officer] (S)
|
|
|
---------+ CON.6.A13 Destruction of Defective Digital Storage Media (S)
|
|
|
---------+ CON.6.A14 Destruction of Storage Media at Increased Security Levels (H)
|
|
|
------+ CON.7 Information Security on Trips Abroad
|
|
|
---------+ CON.7.G1. Eavesdropping and Spying on Information/Industrial Espionage
|
|
|
---------+ CON.7.G2. Disclosure and Misuse of Sensitive Information (Electronic and Physical)
|
|
|
---------+ CON.7.G3. Use of False Identities
|
|
|
---------+ CON.7.G4. Lack of Security Awareness and Carelessness in Handling Information
|
|
|
---------+ CON.7.G5. Violation of Local Laws or Regulations
|
|
|
---------+ CON.7.G6. Coercion, Extortion, Hijacking, and Corruption
|
|
|
---------+ CON.7.G7. Information from Unreliable Sources
|
|
|
---------+ CON.7.G8. Theft or Loss of Devices, Storage Media, and Documents
|
|
|
---------+ CON.7.A1 Security Policy for Information Security on Trips Abroad
|
|
|
---------+ CON.7.A2 Raising Employee Awareness of Information Security When Travelling Abroad (B)
|
|
|
---------+ CON.7.A3 Identification of Country-Specific Regulations, Travel Conditions and Environmental Conditions [Human Resource Department]
|
|
|
---------+ CON.7.A4 Use of Privacy Screens [User] (B)
|
|
|
---------+ CON.7.A5 Use of Screen/Code Locking [User] (B)
|
|
|
---------+ CON.7.A6 Prompt Reporting of a Loss [User]
|
|
|
---------+ CON.7.A7 Secure Remote Access to an Organisation's Network [IT Operation Department, User] (B)
|
|
|
---------+ CON.7.A8 Secure Use of Public WLANs [User] (B)
|
|
|
---------+ CON.7.A9 Secure Handling of Mobile Storage Media [User] (B)
|
|
|
---------+ CON.7.A10 Encryption of Portable IT Systems and Storage Media [User, IT Operation Department] (B)
|
|
|
---------+ CON.7.A12 Secure Destruction of Sensitive Materials and Documents [User] (B)
|
|
|
---------+ CON.7.A11 Use of Anti-Theft Devices [User] (S)
|
|
|
---------+ CON.7.A13 Transporting Necessary Data and Storage Media [User] (S)
|
|
|
---------+ CON.7.A14 Cryptographically Secured E-Mail Communication [User, IT Operation Department] (S)
|
|
|
---------+ CON.7.A15 Emission Security for Portable IT Systems (H)
|
|
|
---------+ CON.7.A16 Protecting Integrity Using Checksums or Digital Signatures [User] (H)
|
|
|
---------+ CON.7.A17 Use of Dedicated Travel Hardware [IT Operation Department] (H)
|
|
|
---------+ CON.7.A18 Restricted Authorisations on Trips Abroad [IT Operation Department] (H)
|
|
|
------+ CON.8 Software Development
|
|
|
---------+ CON.8.G1. Selection of an Unsuitable Process Model
|
|
|
---------+ CON.8.G2. Selection of an Unsuitable Development Environment
|
|
|
---------+ CON.8.G3. Inadequate Quality Assurance in the Development Process
|
|
|
---------+ CON.8.G4. Inadequate Documentation
|
|
|
---------+ CON.8.G5. Inadequately Secured Use of Development Environments
|
|
|
---------+ CON.8.G6. Software Design Errors
|
|
|
---------+ CON.8.G7. Inadequate Testing and Approval Procedures
|
|
|
---------+ CON.8.G8. Software Testing with Production Data
|
|
|
---------+ CON.8.A2 Selection of a Process Model (B)
|
|
|
---------+ CON.8.A3 Selection of a Development Environment (B)
|
|
|
---------+ CON.8.A5 Secure System Design (B)
|
|
|
---------+ CON.8.A6 Use of External Libraries from Trusted Sources (B)
|
|
|
---------+ CON.8.A7 Conducting Software Tests During Development [Tester, Developer] (B)
|
|
|
---------+ CON.8.A8 Provision of Patches, Updates, and Changes [Developer] (B)
|
|
|
---------+ CON.8.A10 Source Code Version Management [Developer] (B)
|
|
|
---------+ CON.8.A20 Checking External Components (B)
|
|
|
---------+ CON.8.A1 Definition of Roles and Responsibilities [Central Administration] (S)
|
|
|
---------+ CON.8.A11 Drawing Up a Policy for Software Development (S)
|
|
|
---------+ CON.8.A12 Detailed Documentation (S)
|
|
|
---------+ CON.8.A14 Training Development Teams on Information Security (S)
|
|
|
---------+ CON.8.A16 Appropriate Control of Software Development (S)
|
|
|
---------+ CON.8.A21 Threat Modelling (S)
|
|
|
---------+ CON.8.A22 Secure Software Design (S)
|
|
|
---------+ CON.8.A17 Selection of Trusted Development Tools (H)
|
|
|
---------+ CON.8.A18 Periodic Security Audits of the Development Environment (H)
|
|
|
---------+ CON.8.A19 Regular Integrity Audits of the Development Environment [IT Operation Department] (H)
|
|
|
------+ CON.9 Information Exchange
|
|
|
---------+ CON.9.G1. Delayed Availability of Information
|
|
|
---------+ CON.9.G2. Unregulated Forwarding of information
|
|
|
---------+ CON.9.G3. Sharing False or Internal Information
|
|
|
---------+ CON.9.G4. Unauthorised Copying and Modification of Information
|
|
|
---------+ CON.9.G5. Inadequate Application of Encryption Procedures
|
|
|
---------+ CON.9.A1 Definition of Authorised Recipients [Central Administration, Users] (B)
|
|
|
---------+ CON.9.A2 Regulating the Exchange of Information [Central Administration, User] (B)
|
|
|
---------+ CON.9.A3 Instruction of Personnel on Exchanges of Information [Process Owner] (B)
|
|
|
---------+ CON.9.A4 Agreements on Exchanging Information with External Parties [Central Administration] (S)
|
|
|
---------+ CON.9.A5 Removal of Residual Information Prior to Sharing [User] (S)
|
|
|
---------+ CON.9.A6 Compatibility Checks on Sender and Recipient Systems (S)
|
|
|
---------+ CON.9.A7 Backup Copies of Transferred Data [User] (S)
|
|
|
---------+ CON.9.A8 Encryption and Digital Signatures (S)
|
|
|
---------+ CON.9.A9 Confidentiality Agreements [Central Administration, User] (H)
|
|
|
------+ CON.10 Development of Web Applications
|
|
|
---------+ CON.10.G1. Bypassing Authorisations in Web Applications
|
|
|
---------+ CON.10.G2. Insufficient Input Validation and Output Encoding
|
|
|
---------+ CON.10.G3. Insufficient Error Handling by Web Applications
|
|
|
---------+ CON.10.G4. Insufficient Logging of Security-Relevant Events
|
|
|
---------+ CON.10.G5. Disclosure of Security-Relevant Information Through Web Applications
|
|
|
---------+ CON.10.G6. Misuse of a Web Application Due to Automated Use
|
|
|
---------+ CON.10.G7. Inadequate Session Management in Web Applications
|
|
|
---------+ CON.10.A1 Authentication for Web Applications (B)
|
|
|
---------+ CON.10.A2 Access Control for Web Applications (B)
|
|
|
---------+ CON.10.A3 Secure Session Management (B)
|
|
|
---------+ CON.10.A4 Controlled Integration of Content in Web Applications (B)
|
|
|
---------+ CON.10.A5 Upload Functions (B)
|
|
|
---------+ CON.10.A6 Protection Against Unauthorised Automated Use of Web Applications (B)
|
|
|
---------+ CON.10.A7 Protection of Confidential Data (B)
|
|
|
---------+ CON.10.A8 Comprehensive Input Validation and Output Encoding (B)
|
|
|
---------+ CON.10.A9 Protection Against SQL Injections (B)
|
|
|
---------+ CON.10.A10 Restrictive Disclosure of Security-Related Information (B)
|
|
|
---------+ CON.10.A11 Software Architecture of a Web Application (S)
|
|
|
---------+ CON.10.A12 Verification of Essential Changes (S)
|
|
|
---------+ CON.10.A13 Error Handling (S)
|
|
|
---------+ CON.10.A14 Secure HTTP Configuration of Web Applications (S)
|
|
|
---------+ CON.10.A15 Prevention of Cross-Site Request Forgery (S)
|
|
|
---------+ CON.10.A16 Multi-Factor Authentication (S)
|
|
|
---------+ CON.10.A17 Preventing Resources from Being Blocked (H)
|
|
|
---------+ CON.10.A18 Cryptographic Protection of Confidential Data (H)
|
|
|
---+ Operations
|
|
|
------+ OPS.1.1.2 Proper IT Administration
|
|
|
---------+ OPS.1.1.2.G1. Failures Caused by Unspecified Responsibilities
|
|
|
---------+ OPS.1.1.2.G2. Shortage of Personnel with Core Competencies
|
|
|
---------+ OPS.1.1.2.G3. Misuse of Administrative Authorisations
|
|
|
---------+ OPS.1.1.2.G4. Inadequate Consideration of Administrative Tasks
|
|
|
---------+ OPS.1.1.2.G5. Operational Disruptions
|
|
|
---------+ OPS.1.1.2.G6. Lack of Options for Investigating Incidents
|
|
|
---------+ OPS.1.1.2.A2 Deputising Rules and Contingency Planning (B)
|
|
|
---------+ OPS.1.1.2.A3 Controlled Hiring of IT Administrators (B)
|
|
|
---------+ OPS.1.1.2.A4 Termination of IT Administration Duties [Human Resources Department] (B)
|
|
|
---------+ OPS.1.1.2.A5 Verifying Administrative Tasks (B)
|
|
|
---------+ OPS.1.1.2.A6 Protecting Administrative Tasks (B)
|
|
|
---------+ OPS.1.1.2.A7 Regulation of IT Administration Tasks (S)
|
|
|
---------+ OPS.1.1.2.A8 Administration of Specialised Applications (S)
|
|
|
---------+ OPS.1.1.2.A9 Sufficient Resources for the IT Operation Department (S)
|
|
|
---------+ OPS.1.1.2.A10 Further Education and Information (S)
|
|
|
---------+ OPS.1.1.2.A11 Documentation of IT Administration Tasks (S)
|
|
|
---------+ OPS.1.1.2.A12 Provisions for Maintenance and Repairs (S)
|
|
|
---------+ OPS.1.1.2.A20 Administration and Commissioning of Devices (S)
|
|
|
---------+ OPS.1.1.2.A14 Security Vetting of Administrators [Human Resources Department] (H)
|
|
|
---------+ OPS.1.1.2.A15 Division of Administrative Activities (H)
|
|
|
---------+ OPS.1.1.2.A16 Access Restrictions for Administrative Access (H)
|
|
|
---------+ OPS.1.1.2.A17 Dual Control in IT Administration (H)
|
|
|
---------+ OPS.1.1.2.A18 Consistent Logging of Administrative Activities (H)
|
|
|
---------+ OPS.1.1.2.A19 Consideration of High-Availability Requirements (H)
|
|
|
------+ OPS.1.1.3 Patch and Change Management
|
|
|
---------+ OPS.1.1.3.G1. Poorly Defined Responsibilities
|
|
|
---------+ OPS.1.1.3.G2. Poor Communication in Change Management
|
|
|
---------+ OPS.1.1.3.G3. Poor Consideration of Business Processes and Specialised Tasks
|
|
|
---------+ OPS.1.1.3.G4. Insufficient resources for patch and change management
|
|
|
---------+ OPS.1.1.3.G5. Problems in Automating the Distribution of Patches and Changes
|
|
|
---------+ OPS.1.1.3.G6. Poor Recovery Options in Patch and Change Management
|
|
|
---------+ OPS.1.1.3.G7. Misjudging the Relevance of Patches and Changes
|
|
|
---------+ OPS.1.1.3.G8. Manipulation of Data and Tools in Change Management
|
|
|
---------+ OPS.1.1.3.A1 Concept for Patch and Change Management [Process Owner] (B)
|
|
|
---------+ OPS.1.1.3.A2 Definition of Responsibilities (B)
|
|
|
---------+ OPS.1.1.3.A3 Configuration of Auto-Update Mechanisms (B)
|
|
|
---------+ OPS.1.1.3.A15 Regular Updating of IT Systems and Software (B)
|
|
|
---------+ OPS.1.1.3.A16 Regular Search for Information on Patches and Vulnerabilities (B)
|
|
|
---------+ OPS.1.1.3.A5 Handling Change Requests [Process Owner] (S)
|
|
|
---------+ OPS.1.1.3.A6 Coordination of Change Requests (S)
|
|
|
---------+ OPS.1.1.3.A7 Integration of Change Management into Business Processes (S)
|
|
|
---------+ OPS.1.1.3.A8 Secure Use of Tools for Patch and Change Management (S)
|
|
|
---------+ OPS.1.1.3.A9 Testing and Acceptance Procedures for New Hardware (S)
|
|
|
---------+ OPS.1.1.3.A10 Assuring the Integrity and Authenticity of Software Packages (S)
|
|
|
---------+ OPS.1.1.3.A11 Continuous Documentation of Information Processing (S)
|
|
|
---------+ OPS.1.1.3.A12 Use of Tools in Change Management (H)
|
|
|
---------+ OPS.1.1.3.A13 Measuring the Success of Change Requests [Process Owner] (H)
|
|
|
---------+ OPS.1.1.3.A14 Synchronisation Within Change Management (H)
|
|
|
------+ OPS.1.1.4 Protection Against Malware
|
|
|
---------+ OPS.1.1.4.G1. Software Vulnerabilities and Drive-By Downloads
|
|
|
---------+ OPS.1.1.4.G2. Extortion through Ransomware
|
|
|
---------+ OPS.1.1.4.G3. Targeted Attacks and Social Engineering
|
|
|
---------+ OPS.1.1.4.G4. Botnets
|
|
|
---------+ OPS.1.1.4.G5. Infection of Production Systems and IoT Devices
|
|
|
---------+ OPS.1.1.4.A1 Creating a Malware Protection Concept (B)
|
|
|
---------+ OPS.1.1.4.A2 Using System-Specific Protection Mechanisms (B)
|
|
|
---------+ OPS.1.1.4.A3 Selection of a Virus Protection Program (B)
|
|
|
---------+ OPS.1.1.4.A5 Operation and Configuration of Virus Protection Programs (B)
|
|
|
---------+ OPS.1.1.4.A6 Regular Updating of Virus Protection Programs and Signatures (B)
|
|
|
---------+ OPS.1.1.4.A7 User Awareness and Obligations [User] (B)
|
|
|
---------+ OPS.1.1.4.A9 Reporting Malware Infections [User] (S)
|
|
|
---------+ OPS.1.1.4.A10 Using Special Analysis Environments (H)
|
|
|
---------+ OPS.1.1.4.A11 Using Several Scan Engines (H)
|
|
|
---------+ OPS.1.1.4.A12 Using Storage Media Locks (H)
|
|
|
---------+ OPS.1.1.4.A13 Handling Untrusted Files (H)
|
|
|
---------+ OPS.1.1.4.A14 Selecting and Using Cyber Security Products to Thwart Targeted Attacks (H)
|
|
|
------+ OPS.1.1.5 Logging
|
|
|
---------+ OPS.1.1.5.G1. Insufficient Logging
|
|
|
---------+ OPS.1.1.5.G2. Incorrect Selection of Relevant Log Data
|
|
|
---------+ OPS.1.1.5.G3. Lack of Proper Time Synchronisation During Logging
|
|
|
---------+ OPS.1.1.5.G4. Poor Planning of Logging
|
|
|
---------+ OPS.1.1.5.G5. Loss of Confidentiality and Integrity in Log Data
|
|
|
---------+ OPS.1.1.5.G6. Incorrectly Configured Logging
|
|
|
---------+ OPS.1.1.5.G7. Failure of Log Data Sources
|
|
|
---------+ OPS.1.1.5.G8. Insufficient Logging Infrastructure Capacity
|
|
|
---------+ OPS.1.1.5.A1 Drawing Up a Security Policy for Logging [Process Owner] (B)
|
|
|
---------+ OPS.1.1.5.A3 Configuring Logging at the System and Network Level (B)
|
|
|
---------+ OPS.1.1.5.A4 Time Synchronisation of IT Systems (B)
|
|
|
---------+ OPS.1.1.5.A5 Complying with Legal Framework Conditions (B)
|
|
|
---------+ OPS.1.1.5.A6 Basic Structure of a Centralised Logging Infrastructure (S)
|
|
|
---------+ OPS.1.1.5.A8 Archiving of Log Data (S)
|
|
|
---------+ OPS.1.1.5.A9 Providing Log Data for Assessment (S)
|
|
|
---------+ OPS.1.1.5.A10 Access Protection for Log Data (S)
|
|
|
---------+ OPS.1.1.5.A11 Increasing the Scope of Logging (H)
|
|
|
---------+ OPS.1.1.5.A12 Encryption of Log Data (H)
|
|
|
---------+ OPS.1.1.5.A13 Highly Available Logging Infrastructure (H)
|
|
|
------+ OPS.1.1.6 Software Tests and Approvals
|
|
|
---------+ OPS.1.1.6.G1. Software Testing with Production Data
|
|
|
---------+ OPS.1.1.6.G2. Insufficient Testing Procedures
|
|
|
---------+ OPS.1.1.6.G3. Insufficient Approval Procedures
|
|
|
---------+ OPS.1.1.6.G4. Inadequate Documentation of Tests and Test Results
|
|
|
---------+ OPS.1.1.6.G5. Inadequate Documentation of Approval Criteria
|
|
|
---------+ OPS.1.1.6.A1 Planning of Software Tests (B)
|
|
|
---------+ OPS.1.1.6.A2 Performing Functional Software Tests [Tester] (B)
|
|
|
---------+ OPS.1.1.6.A3 Assessing Test Results [Tester] (B)
|
|
|
---------+ OPS.1.1.6.A4 Software Approval [Process Owner] (B)
|
|
|
---------+ OPS.1.1.6.A5 Performing Software Tests for Non-Functional Requirements [Tester] (B)
|
|
|
---------+ OPS.1.1.6.A11 Using Anonymised or Pseudonymised Test Data [Data Protection Officer, Tester] (B)
|
|
|
---------+ OPS.1.1.6.A6 Orderly Instruction of Software Testers [Process Owner] (S)
|
|
|
---------+ OPS.1.1.6.A7 Selecting Software Testers [Human Resources Department, Process Owner] (S)
|
|
|
---------+ OPS.1.1.6.A10 Drawing Up an Acceptance Plan (S)
|
|
|
---------+ OPS.1.1.6.A12 Performing Regression Tests [Tester] (S)
|
|
|
---------+ OPS.1.1.6.A13 Separating the Test Environment from the Production Environment (S)
|
|
|
---------+ OPS.1.1.6.A15 Verification of Installation and Related Documentation [Tester] (S)
|
|
|
---------+ OPS.1.1.6.A14 Performing Penetration Tests [Tester] (H)
|
|
|
---------+ OPS.1.1.6.A16 Security Vetting of Testers (H)
|
|
|
------+ OPS.1.1.7 System Management
|
|
|
---------+ OPS.1.1.7.G1. Unauthorised Access to the System Management Solution
|
|
|
---------+ OPS.1.1.7.G2. Errors in Automation Functions for System Management
|
|
|
---------+ OPS.1.1.7.G3. Unauthorised Interference in System Management Communication
|
|
|
---------+ OPS.1.1.7.G4. Insufficient Time Synchronisation of System Management Components
|
|
|
---------+ OPS.1.1.7.G5. Incompatibility Between the Systems to Be Managed and the System Management Solution
|
|
|
---------+ OPS.1.1.7.G6. Loss of Connection Between Users and the System Management Solution
|
|
|
---------+ OPS.1.1.7.G7. Loss of Connection Between the System Management Solution and Systems to be Managed
|
|
|
---------+ OPS.1.1.7.G8. Insufficient Coordination Between System Management and Network Management
|
|
|
---------+ OPS.1.1.7.A1 Specification of System Management Requirements (B)
|
|
|
---------+ OPS.1.1.7.A2 System Management Planning (B)
|
|
|
---------+ OPS.1.1.7.A3 Time Synchronisation for System Management (B)
|
|
|
---------+ OPS.1.1.7.A4 Protection of System Management Communication (B)
|
|
|
---------+ OPS.1.1.7.A5 Mutual Authentication Between the System Management Solution and Systems to be Managed (B)
|
|
|
---------+ OPS.1.1.7.A6 Securing Access to the System Management Solution (B)
|
|
|
---------+ OPS.1.1.7.A7 Definition of a Security Policy for System Management (S)
|
|
|
---------+ OPS.1.1.7.A8 Drawing Up a System Management Concept (S)
|
|
|
---------+ OPS.1.1.7.A9 Detailed and Implementation Planning for System Management (S)
|
|
|
---------+ OPS.1.1.7.A10 Concept for Secure Operation of the System Management Solution (S)
|
|
|
---------+ OPS.1.1.7.A11 Regular Gap Analysis Within the Framework of System Management (S)
|
|
|
---------+ OPS.1.1.7.A12 Triggering Actions by the Central Components of the System Management Solution (S)
|
|
|
---------+ OPS.1.1.7.A13 Commitment to the Use of Designated Interfaces for System Management (S)
|
|
|
---------+ OPS.1.1.7.A14 Central Configuration Management for Systems to be Managed (S)
|
|
|
---------+ OPS.1.1.7.A15 Status Monitoring, Logging, and Alerting of Relevant Events in the System Management Solution and the Systems to be Managed (S)
|
|
|
---------+ OPS.1.1.7.A16 Integration of System Management into Contingency Planning (S)
|
|
|
---------+ OPS.1.1.7.A17 Control of System Management Communication (S)
|
|
|
---------+ OPS.1.1.7.A18 System State Verification (S)
|
|
|
---------+ OPS.1.1.7.A19 Securing System Management Communications Between the System Management Solution and the Systems Being Managed (S)
|
|
|
---------+ OPS.1.1.7.A20 Implementing System Management Solutions for High Availability (H)
|
|
|
---------+ OPS.1.1.7.A21 Physical Separation of the Central System Management Network (H)
|
|
|
---------+ OPS.1.1.7.A22 Integration of System Management into Automated Detection Systems (S)
|
|
|
---------+ OPS.1.1.7.A23 Cross-Site Time Synchronisation for System Management (H)
|
|
|
---------+ OPS.1.1.7.A24 Automated Checking of Security-Relevant Configurations by Suitable Detection Systems (H)
|
|
|
---------+ OPS.1.1.7.A25 Logging and Regulation of System Management Meetings (H)
|
|
|
---------+ OPS.1.1.7.A26 Decoupling of Access to the System Management Solution (H)
|
|
|
------+ OPS.1.2.2 Archiving
|
|
|
---------+ OPS.1.2.2.G1. Obsolescence of Archive Systems
|
|
|
---------+ OPS.1.2.2.G2. Inadequate Indexing Keys for Archives
|
|
|
---------+ OPS.1.2.2.G3. Unauthorised Archive Access due to Insufficient Logging
|
|
|
---------+ OPS.1.2.2.G4. Inadequate Transfer of Paper-Based Data to an Electronic Archive
|
|
|
---------+ OPS.1.2.2.G5. Insufficient Renewal of Cryptographic Procedures During Archiving
|
|
|
---------+ OPS.1.2.2.G6. Insufficient Archiving Audits
|
|
|
---------+ OPS.1.2.2.G7. Violation of Legal Framework Conditions Regarding the Use of Archive Systems
|
|
|
---------+ OPS.1.2.2.A1 Determining Parameters for Electronic Archiving (B)
|
|
|
---------+ OPS.1.2.2.A2 Drawing up an Archiving Concept (B)
|
|
|
---------+ OPS.1.2.2.A3 Appropriate Installation of Archive Systems and Storage of Archive Media [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A4 Consistent Indexing of Data During Archiving [IT Operation Department, User] (B)
|
|
|
---------+ OPS.1.2.2.A5 Regular Regeneration of Archived Data [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A6 Protection of the Integrity of the Index Database of Archive Systems [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A7 Regular Backups of System and Archive Data [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A8 Logging Archival Access [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A9 Selection of Suitable Data Formats for Archiving Documents [IT Operation Department] (B)
|
|
|
---------+ OPS.1.2.2.A10 Drawing Up a Policy for Using Archive Systems [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A11 Instruction Regarding the Administration and Operation of the Archive System [IT Operation Department, User] (S)
|
|
|
---------+ OPS.1.2.2.A12 Monitoring of Storage Resources for Archive Media [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A13 Regular Auditing of Archiving Processes (S)
|
|
|
---------+ OPS.1.2.2.A14 Regular Observation of the Market for Archive Systems [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A15 Regular Processing of Cryptographically Secured Data During Archiving [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A16 Regular Renewal of Technical Archive System Components [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A17 Selecting a Suitable Archiving System [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A18 Using Appropriate Archive Media [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A19 Regular Function and Recovery Tests for Archiving [IT Operation Department] (S)
|
|
|
---------+ OPS.1.2.2.A20 Appropriate Use of Cryptographic Methods for Archiving [IT Operation Department] (H)
|
|
|
---------+ OPS.1.2.2.A21 Transfer of Paper-based Data to Electronic Archives (H)
|
|
|
------+ OPS.1.2.4 Teleworking
|
|
|
---------+ OPS.1.2.4.G1. Insufficient Rules for Teleworking Locations
|
|
|
---------+ OPS.1.2.4.G2. Unauthorised Private Use of Teleworking Computers
|
|
|
---------+ OPS.1.2.4.G3. Delays Caused by Temporarily Restricted Availability of Employees
|
|
|
---------+ OPS.1.2.4.G4. Poor Integration of Employees into the Information Flow
|
|
|
---------+ OPS.1.2.4.G5. Non-Compliance with Security Safeguards
|
|
|
---------+ OPS.1.2.4.A1 Rules on Teleworking [Supervisor, Human Resources Department] (B)
|
|
|
---------+ OPS.1.2.4.A2 Security-Related Requirements for Teleworking Computers (B)
|
|
|
---------+ OPS.1.2.4.A5 Employee Awareness and Training (B)
|
|
|
---------+ OPS.1.2.4.A6 Creating a Security Concept for Teleworking (S)
|
|
|
---------+ OPS.1.2.4.A7 Regulations on Using Communication Capabilities for Teleworking [IT Operation Department, Employee] (S)
|
|
|
---------+ OPS.1.2.4.A8 Flow of Information Between Employees and Organisations [Supervisor, Employee] (S)
|
|
|
---------+ OPS.1.2.4.A9 Support and Maintenance Concept for Teleworking Locations [IT Operation Department, Employee] (S)
|
|
|
---------+ OPS.1.2.4.A10 Analysis of Teleworking Location Requirements [IT Operation Department] (S)
|
|
|
------+ OPS.1.2.5 Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G1. Inadequate Knowledge of Remote Maintenance Regulations
|
|
|
---------+ OPS.1.2.5.G2. Inadequate Planning and Rules for Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G3. Inappropriate Use of Authentication During Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G4. Improper Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G5. Use of Insecure Protocols in Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G6. Insecure and Uncontrolled Use of Remote Maintenance Access by Third Parties
|
|
|
---------+ OPS.1.2.5.G7. Use of Online Services for Remote Maintenance
|
|
|
---------+ OPS.1.2.5.G8. Unknown Remote Maintenance Components
|
|
|
---------+ OPS.1.2.5.A1 Planning the Use of Remote Maintenance (B)
|
|
|
---------+ OPS.1.2.5.A2 Establishing a Secure Connection for Remote Maintenance of Clients [User] (B)
|
|
|
---------+ OPS.1.2.5.A3 Securing Interfaces for Remote Maintenance (B)
|
|
|
---------+ OPS.1.2.5.A5 Use of Online Services (S)
|
|
|
---------+ OPS.1.2.5.A6 Drawing Up a Policy for Remote Maintenance (S)
|
|
|
---------+ OPS.1.2.5.A7 Documentation During Remote Maintenance (S)
|
|
|
---------+ OPS.1.2.5.A8 Secure Protocols for Remote Maintenance (S)
|
|
|
---------+ OPS.1.2.5.A9 Selection and Acquisition of Suitable Remote Maintenance Tools (S)
|
|
|
---------+ OPS.1.2.5.A10 Management of Remote Maintenance Tools (S)
|
|
|
---------+ OPS.1.2.5.A17 Authentication Mechanisms for Remote Maintenance (S)
|
|
|
---------+ OPS.1.2.5.A19 Remote Maintenance by Third Parties (S)
|
|
|
---------+ OPS.1.2.5.A20 Remote Maintenance Operations (S)
|
|
|
---------+ OPS.1.2.5.A21 Creation of a Business Continuity Plan in Case of Remote Maintenance Failure (S)
|
|
|
---------+ OPS.1.2.5.A24 Securing Integrated Remote Maintenance Systems (S)
|
|
|
---------+ OPS.1.2.5.A25 Decoupling of Communication During Remote Maintenance (S)
|
|
|
---------+ OPS.1.2.5.A14 Dedicated Clients for Remote Maintenance (H)
|
|
|
---------+ OPS.1.2.5.A22 Redundant Communication Links (H)
|
|
|
------+ OPS.1.2.6 NTP Time Synchronisation
|
|
|
---------+ OPS.1.2.6.G1. Insufficient Planning of the Use of NTP
|
|
|
---------+ OPS.1.2.6.G2. Missing or Incorrect Time Information
|
|
|
---------+ OPS.1.2.6.G3. Conflicting Time Information
|
|
|
---------+ OPS.1.2.6.G4. Manipulation of NTP Communication
|
|
|
---------+ OPS.1.2.6.A1 Planning the Use of NTPs (B)
|
|
|
---------+ OPS.1.2.6.A2 Secure Use of External Time Sources (B)
|
|
|
---------+ OPS.1.2.6.A3 Secure Configuration of NTP Servers (B)
|
|
|
---------+ OPS.1.2.6.A4 Failure to Account for Unsolicited Time Information (B)
|
|
|
---------+ OPS.1.2.6.A5 Use of Client-Server Mode for NTP (S)
|
|
|
---------+ OPS.1.2.6.A6 Monitoring of IT Systems Using NTP (S)
|
|
|
---------+ OPS.1.2.6.A7 Secure Configuration of NTP Clients (S)
|
|
|
---------+ OPS.1.2.6.A8 Use of Secure Time Synchronisation Protocols (S)
|
|
|
---------+ OPS.1.2.6.A9 Sufficient Availability of Accurate Time Sources (H)
|
|
|
---------+ OPS.1.2.6.A10 Internal NTP Servers Only (H)
|
|
|
---------+ OPS.1.2.6.A11 Redundant NTP Servers (H)
|
|
|
---------+ OPS.1.2.6.A12 NTP Servers with Authenticated Information (H)
|
|
|
------+ OPS.2.1 Outsourcing for Customers
|
|
|
---------+ OPS.2.1.G1. Insufficient Rules Regarding Information Security
|
|
|
---------+ OPS.2.1.G2. Incorrect Administration of Site, System and Data Access Rights
|
|
|
---------+ OPS.2.1.G3. Inadequate testing and approval procedures
|
|
|
---------+ OPS.2.1.G4. Inadequate contractual arrangements with outsourcing service providers
|
|
|
---------+ OPS.2.1.G5. Insufficient terms for the end of an outsourcing project
|
|
|
---------+ OPS.2.1.G6. Dependency on an Outsourcing Service Provider
|
|
|
---------+ OPS.2.1.G7. Disruption of the Office Atmosphere due to an Outsourcing Project
|
|
|
---------+ OPS.2.1.G8. Inadequate Information Security in the Early Stages of Outsourcing
|
|
|
---------+ OPS.2.1.G9. Failure of an Outsourcing Service Provider’s Systems
|
|
|
---------+ OPS.2.1.G10. Vulnerabilities in the Connection to an Outsourcing Service Provider
|
|
|
---------+ OPS.2.1.G11. Lack of Multi-Client Capability with the Outsourcing Service Provider
|
|
|
---------+ OPS.2.1.A1 Specification of Security Requirements for Outsourcing Projects (B)
|
|
|
---------+ OPS.2.1.A2 Timely Involvement of Employee Representatives [Central Administration] (S)
|
|
|
---------+ OPS.2.1.A3 Selection of a Suitable Outsourcing Service Provider (S)
|
|
|
---------+ OPS.2.1.A4 Contractual Arrangements with the Outsourcing Service Provider (S)
|
|
|
---------+ OPS.2.1.A5 Establishing an Outsourcing Strategy (S)
|
|
|
---------+ OPS.2.1.A6 Drawing up a Security Concept for the Outsourcing Project [Process Owner] (S)
|
|
|
---------+ OPS.2.1.A7 Definition of Possible Communication Partners [Central Administration] (S)
|
|
|
---------+ OPS.2.1.A8 Provisions for Deploying the Personnel of the Outsourcing Service Provider [Human Resources Department] (S)
|
|
|
---------+ OPS.2.1.A9 Agreements on Connecting to Outsourcing Partner Networks (S)
|
|
|
---------+ OPS.2.1.A10 Agreement on the Exchange of Data Between Outsourcing Partners (S)
|
|
|
---------+ OPS.2.1.A11 Planning and Maintaining Information Security During Ongoing Outsourcing Operations (S)
|
|
|
---------+ OPS.2.1.A12 Change Management [Process Owner] (S)
|
|
|
---------+ OPS.2.1.A13 Secure Migration in Outsourcing Projects (S)
|
|
|
---------+ OPS.2.1.A14 Contingency Planning for Outsourcing [BCM Officer] (S)
|
|
|
---------+ OPS.2.1.A15 Organised Termination of an Outsourcing Relationship [Procurement Department] (S)
|
|
|
---------+ OPS.2.1.A16 Security Vetting of Employees (H)
|
|
|
------+ OPS.2.2 Cloud Usage
|
|
|
---------+ OPS.2.2.G1. Insufficient Strategy for Cloud Use
|
|
|
---------+ OPS.2.2.G2. Dependence on a Cloud Service Provider (Loss of Control)
|
|
|
---------+ OPS.2.2.G3. Poor Compliance Management When Using the Cloud
|
|
|
---------+ OPS.2.2.G4. Violations of Legal Provisions
|
|
|
---------+ OPS.2.2.G5. Cloud Service Providers Offering Inadequate Multi-Client Capability
|
|
|
---------+ OPS.2.2.G6. Inadequate Contractual Arrangements with a Cloud Service Provider
|
|
|
---------+ OPS.2.2.G7. Lack of Planning of Migrations to Cloud Services
|
|
|
---------+ OPS.2.2.G8. Inadequate Integration of Cloud Services into an Organisation's Own IT
|
|
|
---------+ OPS.2.2.G9. Insufficient Provisions for Termination of Cloud Usage
|
|
|
---------+ OPS.2.2.G10. Inadequate Administration Model for Cloud Use
|
|
|
---------+ OPS.2.2.G11. Insufficient Contingency Planning Concept
|
|
|
---------+ OPS.2.2.G12. Failure in the IT Systems of a Cloud Service Provider
|
|
|
---------+ OPS.2.2.A1 Drawing Up a Strategy for Cloud Usage [Process Owner, Top Management, Data Protection Officer] (B)
|
|
|
---------+ OPS.2.2.A2 Drawing Up a Security Policy for Cloud Usage [Process Owner] (B)
|
|
|
---------+ OPS.2.2.A3 Service Definition for Cloud Services by the Customer [Process Owner] (B)
|
|
|
---------+ OPS.2.2.A4 Definition of Areas of Responsibility and Interfaces [Process Owner] (B)
|
|
|
---------+ OPS.2.2.A5 Planning a Secure Migration to a Cloud Service [Process Owner] (S)
|
|
|
---------+ OPS.2.2.A6 Planning the Secure Integration of Cloud Services (S)
|
|
|
---------+ OPS.2.2.A7 Drawing Up a Security Concept for Cloud Usage (S)
|
|
|
---------+ OPS.2.2.A8 Careful Selection of a Cloud Service Provider [Top Management] (S)
|
|
|
---------+ OPS.2.2.A9 Contractual Arrangements with the Cloud Service Provider [Top Management] (S)
|
|
|
---------+ OPS.2.2.A10 Secure Migration to a Cloud Service [Process Owner] (S)
|
|
|
---------+ OPS.2.2.A11 Drawing Up a Contingency Concept for a Cloud Service (S)
|
|
|
---------+ OPS.2.2.A12 Maintaining Information Security During Live Cloud Operations (S)
|
|
|
---------+ OPS.2.2.A13 Evidence of Sufficient Information Security for Cloud Usage (S)
|
|
|
---------+ OPS.2.2.A14 Orderly Termination of a Cloud Service Relationship [Process Owner, Top Management] (S)
|
|
|
---------+ OPS.2.2.A15 Ensuring the Portability of Cloud Services [Process Owner] (H)
|
|
|
---------+ OPS.2.2.A16 Implementing In-House Backups [Process Owner] (H)
|
|
|
---------+ OPS.2.2.A17 Use of Encryption When Using the Cloud (H)
|
|
|
---------+ OPS.2.2.A18 Use of Federation Services [Process Owner] (H)
|
|
|
---------+ OPS.2.2.A19 Security Vetting of Employees [Human Resources Department] (H)
|
|
|
------+ OPS.3.1 Outsourcing for Service Providers
|
|
|
---------+ OPS.3.1.G1. Failure of a Wide Area Network (WAN)
|
|
|
---------+ OPS.3.1.G2. Insufficient Rules Regarding Information Security
|
|
|
---------+ OPS.3.1.G3. Incorrect Administration of Site, System and Data Access Rights
|
|
|
---------+ OPS.3.1.G4. Inadequate testing and approval procedures
|
|
|
---------+ OPS.3.1.G5. Insecure transport of files and storage media
|
|
|
---------+ OPS.3.1.G6. Insufficient information security management by the outsourcing service provider
|
|
|
---------+ OPS.3.1.G7. Inadequate contractual arrangements with an outsourcing customer
|
|
|
---------+ OPS.3.1.G8. Insufficient terms for the end of an outsourcing arrangement
|
|
|
---------+ OPS.3.1.G9. Inadequate contingency planning for outsourcing
|
|
|
---------+ OPS.3.1.G10. Failure of an outsourcing service provider’s systems
|
|
|
---------+ OPS.3.1.G11. Vulnerabilities in the connection to an outsourcing service provider
|
|
|
---------+ OPS.3.1.G12. Social engineering
|
|
|
---------+ OPS.3.1.G13. Lack of multi-client capability with the outsourcing service provider
|
|
|
---------+ OPS.3.1.A1 Drawing Up a Rough Concept for the Outsourcing Service (B)
|
|
|
---------+ OPS.3.1.A2 Contractual Arrangements with Outsourcing Customers (S)
|
|
|
---------+ OPS.3.1.A3 Creating a Security Concept for the Outsourcing Project (S)
|
|
|
---------+ OPS.3.1.A4 Definition of Possible Communication Partners [Central Administration, Data Protection Officer] (S)
|
|
|
---------+ OPS.3.1.A5 Provisions for Deploying the Personnel of Outsourcing Service Providers [Human Resources Department] (S)
|
|
|
---------+ OPS.3.1.A6 Procedures Regarding the Use of Third-Party Personnel [Human Resources Department] (S)
|
|
|
---------+ OPS.3.1.A7 Creation of a Client Separation Concept by an Outsourcing Service Provider (S)
|
|
|
---------+ OPS.3.1.A8 Agreements on Connecting to Outsourcing Partner Networks (S)
|
|
|
---------+ OPS.3.1.A9 Agreement on the Exchange of Data Between Outsourcing Partners (S)
|
|
|
---------+ OPS.3.1.A10 Planning and Maintaining Information Security During Ongoing Outsourcing Operations (S)
|
|
|
---------+ OPS.3.1.A11 Site, System, and Data Access Control [Central Administration] (S)
|
|
|
---------+ OPS.3.1.A12 Change Management [Organisation] (S)
|
|
|
---------+ OPS.3.1.A13 Secure Migration in Outsourcing Projects (S)
|
|
|
---------+ OPS.3.1.A14 Contingency Planning for Outsourcing [BCM Officer] (S)
|
|
|
---------+ OPS.3.1.A15 Orderly Termination of an Outsourcing Relationship [Top Management] (S)
|
|
|
---------+ OPS.3.1.A16 Security Vetting of Employees [Human Resources Department] (H)
|
|
|
---+ Detection and Response
|
|
|
------+ DER.1 Detecting Security-Relevant Events
|
|
|
---------+ DER.1.G1. Failure to Consider Statutory Provisions and Occupational Rights of Co-Determination
|
|
|
---------+ DER.1.G2. Insufficient Employee Qualifications
|
|
|
---------+ DER.1.G3. Improper Administration of the Detection Systems Used
|
|
|
---------+ DER.1.G4. Lack of Information Regarding the Information Domain to be Protected
|
|
|
---------+ DER.1.G5. Insufficient Use of Detection Systems
|
|
|
---------+ DER.1.G6. Insufficient Personnel Resources
|
|
|
---------+ DER.1.A1 Creation of a Security Policy for the Detection of Security-Relevant Events (B)
|
|
|
---------+ DER.1.A2 Compliance with Legal Conditions When Analysing Log Data (B)
|
|
|
---------+ DER.1.A3 Definition of Reporting Paths for Security-Relevant Events (B)
|
|
|
---------+ DER.1.A4 Raising Employee Awareness [Supervisor, User, Employee] (B)
|
|
|
---------+ DER.1.A5 Use of Detection Features Included in Systems [Process Owner] (B)
|
|
|
---------+ DER.1.A6 Continuous Monitoring and Analysis of Log Data (S)
|
|
|
---------+ DER.1.A7 Training of Responsible Persons [Supervisor] (S)
|
|
|
---------+ DER.1.A9 Use of Additional Detection Systems [Process Owner] (S)
|
|
|
---------+ DER.1.A10 Use of TLS/SSH Proxies [Process Owner] (S)
|
|
|
---------+ DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)
|
|
|
---------+ DER.1.A12 Evaluation of Information from External Sources [Process Owner] (S)
|
|
|
---------+ DER.1.A13 Regular Audits of Detection Systems (S)
|
|
|
---------+ DER.1.A14 Evaluation of Log Data by Specialised Personnel (H)
|
|
|
---------+ DER.1.A15 Central Detection and Real-Time Examination of Event Messages (H)
|
|
|
---------+ DER.1.A16 Use of Detection Systems in Accordance with Protection Requirements (H)
|
|
|
---------+ DER.1.A17 Automatic Reaction to Security-Relevant Events (H)
|
|
|
---------+ DER.1.A18 Performance of Regular Integrity Checks (H)
|
|
|
------+ DER.2.1 Security Incident Handling
|
|
|
---------+ DER.2.1.G1. Inappropriate Handling of Security Incidents
|
|
|
---------+ DER.2.1.G2. Destruction of Evidence While Handling Security Incidents
|
|
|
---------+ DER.2.1.A1 Definition of a Security Incident (B)
|
|
|
---------+ DER.2.1.A2 Drawing Up a Policy for Handling Security Incidents (B)
|
|
|
---------+ DER.2.1.A3 Specification of Responsibilities and Contact Persons in the Event of Security Incidents (B)
|
|
|
---------+ DER.2.1.A4 Notification of Entities Affected by Security Incidents [Top Management, IT Operation Department, Data Protection Officer, BCM Officer] (B)
|
|
|
---------+ DER.2.1.A5 Remedial Action in Connection with Security incidents [IT Operation Department] (B)
|
|
|
---------+ DER.2.1.A6 Recovering the Operating Environment After Security Incidents [IT Operation Department] (B)
|
|
|
---------+ DER.2.1.A7 Establishment of a Procedure for Handling Security Incidents [Top Management] (S)
|
|
|
---------+ DER.2.1.A8 Design of Organisational Structures for Handling Security Incidents (S)
|
|
|
---------+ DER.2.1.A9 Definition of Reporting Paths for Security Incidents (S)
|
|
|
---------+ DER.2.1.A10 Limiting the Effects of Security Incidents [BCM Officer, IT Operation Department] (S)
|
|
|
---------+ DER.2.1.A11 Classification of Security Incidents [IT Operation Department] (B)
|
|
|
---------+ DER.2.1.A12 Specification of Where Security Incident Handling Overlaps with Fault Management [BCM Officer] (S)
|
|
|
---------+ DER.2.1.A13 Integration into Security and Business Continuity Management [BCM Officer] (S)
|
|
|
---------+ DER.2.1.A14 Escalation Strategy for Security Incidents [IT Operation Department] (S)
|
|
|
---------+ DER.2.1.A15 Training Service Desk Employees [IT Operation Department] (S)
|
|
|
---------+ DER.2.1.A16 Documentation for Remedying Security Incidents (S)
|
|
|
---------+ DER.2.1.A17 Evaluation of Security Incidents (S)
|
|
|
---------+ DER.2.1.A18 Further Development of Processes Based on Findings from Security Incidents and Industry Developments [Process Owner] (S)
|
|
|
---------+ DER.2.1.A19 Specifying Priorities for Handling Security Incidents [Top Management] (H)
|
|
|
---------+ DER.2.1.A20 Creation of a Dedicated Reporting Office for Security Incidents (H)
|
|
|
---------+ DER.2.1.A21 Assembling a Team of Experts for Handling Security Incidents (H)
|
|
|
---------+ DER.2.1.A22 Reviewing Management System Efficiency in Handling Security Incidents (H)
|
|
|
------+ DER.2.2 Provisions for IT Forensics
|
|
|
---------+ DER.2.2.G1. Violation of legal framework conditions
|
|
|
---------+ DER.2.2.G2. Failure to Secure Evidence due to Incorrect or Incomplete Methods
|
|
|
---------+ DER.2.2.A1 Examination of Legal and Regulatory Framework Conditions for Acquisition and Evaluation [Data Protection Officer, Top Management] (B)
|
|
|
---------+ DER.2.2.A2 Drawing Up a Guide for Initial Measures in Case of an IT Security Incident (B)
|
|
|
---------+ DER.2.2.A3 Pre-Selection of Forensic Service Providers (B)
|
|
|
---------+ DER.2.2.A4 Identifying Common Areas Between IT Forensics and Crisis/Business Continuity Management (S)
|
|
|
---------+ DER.2.2.A5 Drawing Up a Guide to Securing Evidence in Case of IT Security Incidents (S)
|
|
|
---------+ DER.2.2.A6 Training Personnel on Forensic Securing of Evidence (S)
|
|
|
---------+ DER.2.2.A7 Selecting Tools for Forensics (S)
|
|
|
---------+ DER.2.2.A8 Selection and Order of Evidence to Be Secured [Process Owner] (S)
|
|
|
---------+ DER.2.2.A9 Pre-Selection of Forensically Relevant Data [Process Owner] (S)
|
|
|
---------+ DER.2.2.A10 Forensic Securing of IT Evidence [Process Owner] (S)
|
|
|
---------+ DER.2.2.A11 Documentation of Securing Evidence [Process Owner] (S)
|
|
|
---------+ DER.2.2.A12 Secure Storage of Original Storage Media and Evidence [Process Owner] (S)
|
|
|
---------+ DER.2.2.A13 Framework Agreements with External Service Providers (H)
|
|
|
---------+ DER.2.2.A14 Specifying Standard Procedures for Securing Evidence (H)
|
|
|
---------+ DER.2.2.A15 Conducting Drills on Securing Evidence (H)
|
|
|
------+ DER.2.3 Clean-Up of Extensive Security Incidents
|
|
|
---------+ DER.2.3.G1. Incomplete Cleaning
|
|
|
---------+ DER.2.3.G2. Destruction of Trace Evidence
|
|
|
---------+ DER.2.3.G3. Premature Alerting of the Attacker
|
|
|
---------+ DER.2.3.G4. Data Loss and Failure of IT Systems
|
|
|
---------+ DER.2.3.G5. Lack of Network Restructuring after an APT Attack
|
|
|
---------+ DER.2.3.A1 Creation of a Management Committee (B)
|
|
|
---------+ DER.2.3.A2 Deciding on a Cleaning Strategy (B)
|
|
|
---------+ DER.2.3.A3 Isolation of Affected Network Segments (B)
|
|
|
---------+ DER.2.3.A4 Blocking and Changing Access Data and Cryptographic Keys (B)
|
|
|
---------+ DER.2.3.A5 Closing the Initial Entry Route (B)
|
|
|
---------+ DER.2.3.A6 Returning to Production Operations (B)
|
|
|
---------+ DER.2.3.A7 Targeted System Hardening (S)
|
|
|
---------+ DER.2.3.A8 Establishing Secure, Independent Communication Channels (S)
|
|
|
---------+ DER.2.3.A9 Hardware Replacement in Affected IT Systems (H)
|
|
|
---------+ DER.2.3.A10 Modifications to Help Thwart a Repeat Attack (H)
|
|
|
------+ DER.3.1 Audits and Revisions
|
|
|
---------+ DER.3.1.G1. Insufficient or Unplanned Implementation of Security Safeguards
|
|
|
---------+ DER.3.1.G2. Ineffective or Inefficient Implementation of Security Safeguards
|
|
|
---------+ DER.3.1.G3. Insufficient Implementation of the ISMS
|
|
|
---------+ DER.3.1.G4. Insufficient Auditor Qualifications
|
|
|
---------+ DER.3.1.G5. Lack of Long-Term Planning
|
|
|
---------+ DER.3.1.G6. Lack of Planning and Coordination when Performing an Audit
|
|
|
---------+ DER.3.1.G7. Lack of Coordination with Employee Representatives
|
|
|
---------+ DER.3.1.G8. Deliberate Concealment of Deviations
|
|
|
---------+ DER.3.1.A1 Definition of Responsibilities [Top Management] (B)
|
|
|
---------+ DER.3.1.A2 Preparing an Audit or Revision (B)
|
|
|
---------+ DER.3.1.A3 Conducting an Audit [Audit Team] (B)
|
|
|
---------+ DER.3.1.A4 Performing a Revision (B)
|
|
|
---------+ DER.3.1.A5 Integration into the Information Security Process (S)
|
|
|
---------+ DER.3.1.A6 Definition of an Audit and Revision Basis and a Uniform Evaluation Scheme (S)
|
|
|
---------+ DER.3.1.A7 Drawing Up an Audit Program (S)
|
|
|
---------+ DER.3.1.A8 Creation of a Revision List (S)
|
|
|
---------+ DER.3.1.A9 Selection of an Appropriate Audit Team or Revision Team (S)
|
|
|
---------+ DER.3.1.A10 Creation of a Audit Plan or Revision Plan [Audit Team] (S)
|
|
|
---------+ DER.3.1.A11 Communication and Behaviour During Audits [Audit Team] (S)
|
|
|
---------+ DER.3.1.A12 Holding an Initial Meeting [Audit Team] (S)
|
|
|
---------+ DER.3.1.A13 Inspection and Review of Documents [Audit Team] (S)
|
|
|
---------+ DER.3.1.A14 Selection of Samples [Audit Team] (S)
|
|
|
---------+ DER.3.1.A15 Selection of Appropriate Audit Techniques [Audit Team] (S)
|
|
|
---------+ DER.3.1.A16 Schedule of the On-Site Audit [Audit Team] (S)
|
|
|
---------+ DER.3.1.A17 Performance of the On-Site Audit [Audit Team] (S)
|
|
|
---------+ DER.3.1.A18 Conducting Interviews [Audit Team] (S)
|
|
|
---------+ DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)
|
|
|
---------+ DER.3.1.A20 Holding a Closing Meeting [Audit Team] (S)
|
|
|
---------+ DER.3.1.A21 Analysis of Audits [Audit Team] (S)
|
|
|
---------+ DER.3.1.A22 Creation of an Audit Report [Audit Team] (S)
|
|
|
---------+ DER.3.1.A23 Documentation of Revision Results (S)
|
|
|
---------+ DER.3.1.A24 Conclusion of the Audit or Revision [Audit Team] (S)
|
|
|
---------+ DER.3.1.A25 Evaluation of an Audit (S)
|
|
|
---------+ DER.3.1.A26 Monitoring and Adapting the Audit Program (S)
|
|
|
---------+ DER.3.1.A27 Storage and Archiving of Documents on Audits and Revisions (S)
|
|
|
------+ DER.3.2 Audits Based on the BSI “Guideline for IS Audits”
|
|
|
---------+ DER.3.2.G1. Violation of Specifications of UP Bund
|
|
|
---------+ DER.3.2.G2. Suspension of Security Safeguards
|
|
|
---------+ DER.3.2.G3. Ineffective or Inefficient Implementation of Security Safeguards
|
|
|
---------+ DER.3.2.G4. Inadequate Implementation of the Information Security Management System
|
|
|
---------+ DER.3.2.G5. Insufficient Auditor Qualifications
|
|
|
---------+ DER.3.2.G6. Partiality of Internal IS Audit Teams
|
|
|
---------+ DER.3.2.G7. Lack of Long-Term Planning
|
|
|
---------+ DER.3.2.G8. Insufficient Planning and Coordination when Performing IS Audits
|
|
|
---------+ DER.3.2.G9. Lack of Coordination with Employee Representatives
|
|
|
---------+ DER.3.2.G10. Deliberate Concealment of Deviations or Problems
|
|
|
---------+ DER.3.2.G11. Loss of Confidentiality of Sensitive Information
|
|
|
---------+ DER.3.2.A1 Designation of Persons in Charge of the IS Audit [Top Management] (B)
|
|
|
---------+ DER.3.2.A2 Creation of an IS Audit Manual (B)
|
|
|
---------+ DER.3.2.A3 Definition of the Audit Basis (B)
|
|
|
---------+ DER.3.2.A4 Drawing Up a Plan for the IS Audit (B)
|
|
|
---------+ DER.3.2.A5 Selection of an Appropriate IS Audit Team (B)
|
|
|
---------+ DER.3.2.A6 Preparation of an IS Audit [IS Audit Team] (B)
|
|
|
---------+ DER.3.2.A7 Performance of an IS Audit [IS Audit Team] (B)
|
|
|
---------+ DER.3.2.A8 Storage of IS Audit Reports (B)
|
|
|
---------+ DER.3.2.A9 Integration into the Information Security Process (S)
|
|
|
---------+ DER.3.2.A10 Communication Coordination (S)
|
|
|
---------+ DER.3.2.A11 Holding an Initial Meeting for an IS Cross-Cutting Audit [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A12 Creation of a Gap Analysis Plan [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A13 Inspection and Review of Documents [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A14 Selection of Target Objects and Requirements to Be Audited [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A15 Selection of Appropriate Audit Techniques [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A16 Creating a Procedure for the On-Site Audit [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A17 Conducting the On-Site Audit [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A18 Conducting Interviews [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A19 Reviewing Risk Treatment Options [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A20 Following Up on the On-Site Audit [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A21 Creation of an IS Audit Report [IS Audit Team] (S)
|
|
|
---------+ DER.3.2.A22 Following Up on an IS Audit (S)
|
|
|
------+ DER.4 Business Continuity Management
|
|
|
---------+ DER.4.G1. Shortage of Personnel
|
|
|
---------+ DER.4.G2. Failure of IT Systems
|
|
|
---------+ DER.4.G3. Failure of a Wide Area Network (WAN)
|
|
|
---------+ DER.4.G4. Inability to Use a Building
|
|
|
---------+ DER.4.G5. Unavailability of a Supplier or Service Provider
|
|
|
---------+ DER.4.A1 Creating a Business Continuity Plan (S)
|
|
|
---------+ DER.4.A2 Integration of Business Continuity Management and Information Security Management [Chief Information Security Officer (CISO)] (S)
|
|
|
---------+ DER.4.A3 Specifying the Scope and the Business Continuity Strategy [Top Management] (H)
|
|
|
---------+ DER.4.A4 Policy for Business Continuity Management and Acceptance of Overall Responsibility by Top Management [Top Management] (H)
|
|
|
---------+ DER.4.A5 Establishing a Suitable Organisational Structure for Business Continuity Management [Top Management] (H)
|
|
|
---------+ DER.4.A6 Providing Adequate Resources for Business Continuity Management [Top Management] (H)
|
|
|
---------+ DER.4.A7 Creating a Contingency Concept [Top Management] (CIA)
|
|
|
---------+ DER.4.A8 Integrating Employees into the Business Continuity Management Process [Supervisor, Human Resources Department] (H)
|
|
|
---------+ DER.4.A9 Integrating Business Continuity Management into Organisation-Wide Procedures and Processes [Top Management] (H)
|
|
|
---------+ DER.4.A10 Tests and Emergency Drills [Top Management] (H)
|
|
|
---------+ DER.4.A12 Documentation in the Business Continuity Management Process (H)
|
|
|
---------+ DER.4.A13 Checking and Controlling the Business Continuity Management System [Top Management] (H)
|
|
|
---------+ DER.4.A14 Regular Checking and Improvement of Business Continuity Safeguards [Top Management] (H)
|
|
|
---------+ DER.4.A15 Assessing the Performance of the Business Continuity Management System [Top Management] (H)
|
|
|
---------+ DER.4.A16 Contingency Planning and Emergency Response Planning for Outsourced Components [Top Management] (H)
|
|
|
---+ Applications
|
|
|
------+ APP.1.1 Office Products
|
|
|
---------+ APP.1.1.G1. Poor Adaptation of Office Products to an Organisation's Requirements
|
|
|
---------+ APP.1.1.G2. Harmful Content in Office documents
|
|
|
---------+ APP.1.1.G3. Loss of Integrity of Office Documents
|
|
|
---------+ APP.1.1.A2 Limiting Active Content (B)
|
|
|
---------+ APP.1.1.A3 Secure Opening of Documents from External Sources [User] (B)
|
|
|
---------+ APP.1.1.A17 Awareness of Specific Office Properties (B)
|
|
|
---------+ APP.1.1.A6 Testing New Versions of Office Products (S)
|
|
|
---------+ APP.1.1.A10 Regulations for Software Development by End Users (S)
|
|
|
---------+ APP.1.1.A11 Controlled Use of Extensions for Office Products (S)
|
|
|
---------+ APP.1.1.A12 No Cloud Storage [User] (S)
|
|
|
---------+ APP.1.1.A13 Use of Viewer Features [User] (S)
|
|
|
---------+ APP.1.1.A14 Protection Against Subsequent Changes to Documents [User] (S)
|
|
|
---------+ APP.1.1.A15 Use of Encryption and Digital Signatures (H)
|
|
|
---------+ APP.1.1.A16 Checking Document Integrity (H)
|
|
|
------+ APP.1.2 Web Browsers
|
|
|
---------+ APP.1.2.G1. Execution of Malicious Code by Web Browsers
|
|
|
---------+ APP.1.2.G2. Exploit Kits
|
|
|
---------+ APP.1.2.G3. Eavesdropping on Internet Communications
|
|
|
---------+ APP.1.2.G4. Loss of Integrity in Web Browsers
|
|
|
---------+ APP.1.2.G5. Loss of Privacy
|
|
|
---------+ APP.1.2.A1 Use of Basic Security Mechanisms (B)
|
|
|
---------+ APP.1.2.A2 Support for Secure Communication Encryption (B)
|
|
|
---------+ APP.1.2.A3 Use of Trusted Certificates (B)
|
|
|
---------+ APP.1.2.A6 Password Management in Web Browsers (B)
|
|
|
---------+ APP.1.2.A13 Use of DNS over HTTPS (B)
|
|
|
---------+ APP.1.2.A7 Data Economy in Web Browsers [User] (S)
|
|
|
---------+ APP.1.2.A9 Using an Isolated Web Browser Environment (H)
|
|
|
---------+ APP.1.2.A10 Using the Private Mode [User] (H)
|
|
|
---------+ APP.1.2.A11 Checking for Malicious Content (H)
|
|
|
---------+ APP.1.2.A12 Two-Browser Strategy (H)
|
|
|
------+ APP.1.4 Mobile Applications (Apps)
|
|
|
---------+ APP.1.4.G1. Inappropriate Selection of apps
|
|
|
---------+ APP.1.4.G2. Excessive Authorisations
|
|
|
---------+ APP.1.4.G3. Undesired Functions in Apps
|
|
|
---------+ APP.1.4.G4. Software Vulnerabilities and Errors in Apps
|
|
|
---------+ APP.1.4.G5. Insecure storage of local application data
|
|
|
---------+ APP.1.4.G6. Deriving Confidential Information from Metadata
|
|
|
---------+ APP.1.4.G7. Leaks of Confidential Data
|
|
|
---------+ APP.1.4.G8. Insecure Communication with Back-End Systems
|
|
|
---------+ APP.1.4.G9. Communication Channels Beyond an Organisation’s Infrastructure
|
|
|
---------+ APP.1.4.A1 Requirements Analysis for the Use of Apps [Process Owner] (B)
|
|
|
---------+ APP.1.4.A5 Minimising and Checking App Authorisations [Process Owner] (B)
|
|
|
---------+ APP.1.4.A7 Secure Storage of Local App Data (B)
|
|
|
---------+ APP.1.4.A8 Preventing Data Leaks (B)
|
|
|
---------+ APP.1.4.A3 Distributing Sensitive Apps (S)
|
|
|
---------+ APP.1.4.A12 Secure App Removal (S)
|
|
|
---------+ APP.1.4.A14 Support for Additional Authentication Features for Apps (H)
|
|
|
---------+ APP.1.4.A15 Performing Penetration Tests for Apps (H)
|
|
|
---------+ APP.1.4.A16 Mobile Application Management (H)
|
|
|
------+ APP.2.1 General Directory Service
|
|
|
---------+ APP.2.1.G1. Inadequate Planning of the Use of Directory Services
|
|
|
---------+ APP.2.1.G2. Inadequate Planning of Partitioning and Replication in the Directory Service
|
|
|
---------+ APP.2.1.G3. Inadequate Planning of Directory Service Access
|
|
|
---------+ APP.2.1.G4. Incorrect Administration of System and Data Access Rights
|
|
|
---------+ APP.2.1.G5. Errors in the Configuration of Directory Service Access
|
|
|
---------+ APP.2.1.G6. Failure of Directory Services
|
|
|
---------+ APP.2.1.G7. Infiltration of Directory Services due to Unauthorised Access
|
|
|
---------+ APP.2.1.G8. Improper Configuration of Directory Services
|
|
|
---------+ APP.2.1.A1 Creation of a Security Policy for Directory Services (B)
|
|
|
---------+ APP.2.1.A2 Planning the Use of Directory Services [Data Protection Officer, Process Owner] (B)
|
|
|
---------+ APP.2.1.A3 Setting Up Access Authorisations for Directory Services [Process Owner] (B)
|
|
|
---------+ APP.2.1.A4 Secure Installation of Directory Services (B)
|
|
|
---------+ APP.2.1.A5 Secure Configuration and Configuration Changes in Directory Services (B)
|
|
|
---------+ APP.2.1.A6 Secure Operation of Directory Services (B)
|
|
|
---------+ APP.2.1.A7 Drawing Up a Security Concept for the Use of Directory Services (S)
|
|
|
---------+ APP.2.1.A8 Planning of Partitioning and Replication in the Directory Service (S)
|
|
|
---------+ APP.2.1.A9 Selection of Suitable Components for Directory Services [Process Owner] (S)
|
|
|
---------+ APP.2.1.A11 Setting Up Access to Directory Services (S)
|
|
|
---------+ APP.2.1.A12 Monitoring Directory Services (S)
|
|
|
---------+ APP.2.1.A13 Protection of Communications with Directory Services (S)
|
|
|
---------+ APP.2.1.A14 Orderly Decommissioning of a Directory Service [Process Owner] (S)
|
|
|
---------+ APP.2.1.A15 Migration of Directory Services (S)
|
|
|
---------+ APP.2.1.A16 Creation of a Business Continuity Plan for Directory Service Failure (H)
|
|
|
------+ APP.2.2 Active Directory
|
|
|
---------+ APP.2.2.G1. Inadequate Planning of Security Boundaries
|
|
|
---------+ APP.2.2.G2. Excessive or Negligent Trust Relationships
|
|
|
---------+ APP.2.2.G3. Lack of Security Features due to Older Operating Systems and Domain Functional Level
|
|
|
---------+ APP.2.2.G4. Operation of Additional Roles and Services on Domain Controllers
|
|
|
---------+ APP.2.2.G5. Insufficient Monitoring and Documentation of Delegated Rights
|
|
|
---------+ APP.2.2.G6. Insecure Authentication
|
|
|
---------+ APP.2.2.G7. Overly Powerful or Insufficiently Secure Service Accounts
|
|
|
---------+ APP.2.2.G8. Use of the Same Local Administrator Password on Multiple IT Systems
|
|
|
---------+ APP.2.2.A1 Planning Active Directory [Process Owner] (B)
|
|
|
---------+ APP.2.2.A2 Planning of Active Directory Administration [Process Owner] (B)
|
|
|
---------+ APP.2.2.A3 Planning of Group Policy in Windows (B)
|
|
|
---------+ APP.2.2.A5 Hardening Active Directory (B)
|
|
|
---------+ APP.2.2.A6 Maintaining the Operational Continuity of Active Directory (B)
|
|
|
---------+ APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)
|
|
|
---------+ APP.2.2.A8 Configuration of Secure Channel in Windows (S)
|
|
|
---------+ APP.2.2.A9 Authentication Protection When Using Active Directory (S)
|
|
|
---------+ APP.2.2.A10 Secure Use of DNS for Active Directory (S)
|
|
|
---------+ APP.2.2.A11 Monitoring Active Directory Infrastructure (S)
|
|
|
---------+ APP.2.2.A12 Backups for Domain Controllers (S)
|
|
|
---------+ APP.2.2.A14 Use of Dedicated Privileged Administration Systems (H)
|
|
|
---------+ APP.2.2.A15 Separation of Administration and Production Environments (H)
|
|
|
------+ APP.2.3 OpenLDAP
|
|
|
---------+ APP.2.3.G1. Inadequate Planning of OpenLDAP
|
|
|
---------+ APP.2.3.G2. Inadequate Separation of offline and online access to OpenLDAP
|
|
|
---------+ APP.2.3.A1 Planning and Selecting Back Ends and Overlays for OpenLDAP (B)
|
|
|
---------+ APP.2.3.A3 Secure Configuration of OpenLDAP (B)
|
|
|
---------+ APP.2.3.A4 Configuration of the Database Used by OpenLDAP (B)
|
|
|
---------+ APP.2.3.A5 Secure Assignment of Access Rights to OpenLDAP (B)
|
|
|
---------+ APP.2.3.A6 Secure Authentication for OpenLDAP (B)
|
|
|
---------+ APP.2.3.A8 Restrictions on Attributes in OpenLDAP (S)
|
|
|
---------+ APP.2.3.A9 Partitioning and Replication in OpenLDAP (S)
|
|
|
---------+ APP.2.3.A10 Secure Updating of OpenLDAP (S)
|
|
|
---------+ APP.2.3.A11 Restriction of the OpenLDAP Runtime Environment (S)
|
|
|
------+ APP.3.1 Web Applications and Web Services
|
|
|
---------+ APP.3.1.G1. Insufficient Logging of Security-Relevant events
|
|
|
---------+ APP.3.1.G2. Disclosure of Security-Relevant Information in Web Applications and Web Services
|
|
|
---------+ APP.3.1.G3. Misuse of a Web Application Due to Automated Use
|
|
|
---------+ APP.3.1.G4. Insufficient Authentication
|
|
|
---------+ APP.3.1.A1 Authentication (B)
|
|
|
---------+ APP.3.1.A4 Controlled Integration of Files and Content (B)
|
|
|
---------+ APP.3.1.A7 Protection Against Unauthorised Automated Use (B)
|
|
|
---------+ APP.3.1.A14 Protection of Confidential Data (B)
|
|
|
---------+ APP.3.1.A8 System Architecture [Procurement Department] (S)
|
|
|
---------+ APP.3.1.A9 Web Application and Web Service Procurement (S)
|
|
|
---------+ APP.3.1.A11 Secure Integration of Background Systems (S)
|
|
|
---------+ APP.3.1.A12 Secure Configuration (S)
|
|
|
---------+ APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)
|
|
|
---------+ APP.3.1.A22 Penetration Testing and Auditing (S)
|
|
|
---------+ APP.3.1.A20 Use of Web Application Firewalls (H)
|
|
|
------+ APP.3.2 Web Servers
|
|
|
---------+ APP.3.2.G1. Loss of Reputation
|
|
|
---------+ APP.3.2.G2. Web Server Manipulation
|
|
|
---------+ APP.3.2.G3. Denial of Service (DoS)
|
|
|
---------+ APP.3.2.G4. Loss of Confidential Data
|
|
|
---------+ APP.3.2.G5. Violation of Laws or Regulations
|
|
|
---------+ APP.3.2.G6. Insufficient Troubleshooting
|
|
|
---------+ APP.3.2.A1 Secure Web Server Configuration (B)
|
|
|
---------+ APP.3.2.A2 Protection of Web Server Files (B)
|
|
|
---------+ APP.3.2.A3 Protecting File Uploads and Downloads (B)
|
|
|
---------+ APP.3.2.A4 Logging of Events (B)
|
|
|
---------+ APP.3.2.A5 Authentication (B)
|
|
|
---------+ APP.3.2.A7 Legal Framework Conditions for Websites [Process Owner, Central Administration, Compliance Manager] (B)
|
|
|
---------+ APP.3.2.A11 Encryption via TLS (B)
|
|
|
---------+ APP.3.2.A8 Planning the Use of a Web Server (S)
|
|
|
---------+ APP.3.2.A9 Defining a Web Server Security Policy (S)
|
|
|
---------+ APP.3.2.A10 Selecting an Appropriate Web Host (S)
|
|
|
---------+ APP.3.2.A12 Suitable Handling of Errors and Error Messages (S)
|
|
|
---------+ APP.3.2.A13 Access Control for Web Crawlers (S)
|
|
|
---------+ APP.3.2.A14 Integrity Checks and Protection Against Malware (S)
|
|
|
---------+ APP.3.2.A16 Penetration Testing and Auditing (S)
|
|
|
---------+ APP.3.2.A20 Appointing Contact Persons [Central Administration] (S)
|
|
|
---------+ APP.3.2.A15 Redundancy (H)
|
|
|
---------+ APP.3.2.A18 Protection Against Denial-of-Service Attacks (H)
|
|
|
------+ APP.3.3 File Servers
|
|
|
---------+ APP.3.3.G1. File Server Failure
|
|
|
---------+ APP.3.3.G2. Insufficient File Server Characteristics
|
|
|
---------+ APP.3.3.G3. Insufficient Checking of Stored Files
|
|
|
---------+ APP.3.3.G4. Insufficient Access Authorisation Concept
|
|
|
---------+ APP.3.3.G5. Unstructured Data Storage
|
|
|
---------+ APP.3.3.G6. Loss of Data Stored on File Servers
|
|
|
---------+ APP.3.3.G7. Ransomware
|
|
|
---------+ APP.3.3.A2 Use of RAID Systems (B)
|
|
|
---------+ APP.3.3.A3 Use of Anti-Virus Programs (B)
|
|
|
---------+ APP.3.3.A15 Planning File Servers (B)
|
|
|
---------+ APP.3.3.A6 Acquiring a File Server and Selecting a Service (S)
|
|
|
---------+ APP.3.3.A7 Selecting a File System (S)
|
|
|
---------+ APP.3.3.A8 Structured Data Storage [User] (S)
|
|
|
---------+ APP.3.3.A9 Secure Storage Management (S)
|
|
|
---------+ APP.3.3.A11 Using Storage Restrictions (S)
|
|
|
---------+ APP.3.3.A14 Using Error Correction Codes (S)
|
|
|
---------+ APP.3.3.A12 Data Encryption (H)
|
|
|
---------+ APP.3.3.A13 Replicating Between Locations (H)
|
|
|
------+ APP.3.4 Samba
|
|
|
---------+ APP.3.4.G1. Eavesdropping on Unprotected Samba Communication Links
|
|
|
---------+ APP.3.4.G2. Insecure Default Settings on Samba Servers
|
|
|
---------+ APP.3.4.G3. Unauthorised Use or Administration of Samba
|
|
|
---------+ APP.3.4.G4. Incorrect Administration of Samba
|
|
|
---------+ APP.3.4.G5. Data Loss in Samba Environments
|
|
|
---------+ APP.3.4.G6. Loss of Integrity of Sensitive Information in Samba Environments
|
|
|
---------+ APP.3.4.A1 Planning the Use of a Samba Server (B)
|
|
|
---------+ APP.3.4.A2 Secure Basic Configuration of a Samba Server (B)
|
|
|
---------+ APP.3.4.A3 Secure Configuration of a Samba Server (S)
|
|
|
---------+ APP.3.4.A4 Avoiding NTFS File Properties on a Samba Server (S)
|
|
|
---------+ APP.3.4.A5 Secure Configuration of a Samba Server's Access Controls (S)
|
|
|
---------+ APP.3.4.A6 Secure Configuration of Winbind in Samba (S)
|
|
|
---------+ APP.3.4.A7 Secure DNS Configuration in Samba (S)
|
|
|
---------+ APP.3.4.A8 Secure LDAP Configuration in Samba (S)
|
|
|
---------+ APP.3.4.A9 Secure Configuration of Kerberos in Samba (S)
|
|
|
---------+ APP.3.4.A10 Secure Use of External Programs on a Samba Server (S)
|
|
|
---------+ APP.3.4.A12 Training Samba Server Administrators (S)
|
|
|
---------+ APP.3.4.A13 Regular Backups of Important Samba Server Components (S)
|
|
|
---------+ APP.3.4.A15 Encryption of Data Packets in Samba (H)
|
|
|
------+ APP.3.6 DNS Servers
|
|
|
---------+ APP.3.6.G1. DNS Server Failure
|
|
|
---------+ APP.3.6.G2. Inadequate Line Bandwidth
|
|
|
---------+ APP.3.6.G3. Inadequate planning of DNS usage
|
|
|
---------+ APP.3.6.G4. Incorrect Domain Information
|
|
|
---------+ APP.3.6.G5. Incorrect Configuration of a DNS Server
|
|
|
---------+ APP.3.6.G6. DNS Manipulation
|
|
|
---------+ APP.3.6.G7. DNS Hijacking
|
|
|
---------+ APP.3.6.G8. DNS DoS
|
|
|
---------+ APP.3.6.G9. DNS Reflection
|
|
|
---------+ APP.3.6.A1 Planning the Use of VPNs (B)
|
|
|
---------+ APP.3.6.A2 Deployment of Redundant DNS Servers (B)
|
|
|
---------+ APP.3.6.A3 Use of Separate DNS Servers for Internal and External Requests (B)
|
|
|
---------+ APP.3.6.A4 Secure Basic Configuration of a DNS Server (B)
|
|
|
---------+ APP.3.6.A6 Securing Dynamic DNS Updates (B)
|
|
|
---------+ APP.3.6.A7 Monitoring of DNS Servers (B)
|
|
|
---------+ APP.3.6.A8 Administration of Domain Names [Central Administration] (B)
|
|
|
---------+ APP.3.6.A9 Creation of a Business Continuity Plan for DNS Servers (B)
|
|
|
---------+ APP.3.6.A10 Selection of a Suitable DNS Server Product (S)
|
|
|
---------+ APP.3.6.A11 Sufficient Capacity of DNS Servers (S)
|
|
|
---------+ APP.3.6.A13 Limited Visibility of Domain Information (S)
|
|
|
---------+ APP.3.6.A14 Location of Name Servers (S)
|
|
|
---------+ APP.3.6.A15 Analysis of Log Data (S)
|
|
|
---------+ APP.3.6.A16 Integrating a DNS Server into a “P-A-P” Structure (S)
|
|
|
---------+ APP.3.6.A17 Use of DNSSEC (S)
|
|
|
---------+ APP.3.6.A18 Advanced Securing of Zone Transfers (S)
|
|
|
---------+ APP.3.6.A19 Disposal of DNS Servers (S)
|
|
|
---------+ APP.3.6.A20 Feasibility Reviews of Business Continuity Plans (H)
|
|
|
---------+ APP.3.6.A21 Hidden Master (H)
|
|
|
---------+ APP.3.6.A22 Connecting DNS Servers via Different Providers (H)
|
|
|
------+ APP.4.2 SAP ERP Systems
|
|
|
---------+ APP.4.2.G1. Lack of Consideration of SAP Security Recommendations
|
|
|
---------+ APP.4.2.G2. Insufficient Application of Patches and SAP Security Notes
|
|
|
---------+ APP.4.2.G3. Lack of Planning, Implementation, and Documentation of an SAP Access Control Policy
|
|
|
---------+ APP.4.2.G4. Lack of SAP Documentation and Contingency Concepts
|
|
|
---------+ APP.4.2.A1 Secure Configuration of the SAP Java Stack (B)
|
|
|
---------+ APP.4.2.A2 Secure Configuration of the SAP Java Stack (B)
|
|
|
---------+ APP.4.2.A3 Network Security (B)
|
|
|
---------+ APP.4.2.A4 Protection of Standard SAP User IDs (B)
|
|
|
---------+ APP.4.2.A5 Configuration and Protection of SAP User Administration (B)
|
|
|
---------+ APP.4.2.A6 Creation and Implementation of a User and Access Control Policy [Department, Developer] (B)
|
|
|
---------+ APP.4.2.A7 Protection of SAP Databases (B)
|
|
|
---------+ APP.4.2.A8 Protection of the SAP RFC Interface (B)
|
|
|
---------+ APP.4.2.A9 Protecting and Monitoring the Message Server (B)
|
|
|
---------+ APP.4.2.A11 Secure Installation of an SAP ERP System (S)
|
|
|
---------+ APP.4.2.A12 SAP Authorisation Development [Department, Developer] (S)
|
|
|
---------+ APP.4.2.A13 SAP Password Security (S)
|
|
|
---------+ APP.4.2.A14 Identification of Critical SAP Authorisations [Department] (S)
|
|
|
---------+ APP.4.2.A15 Secure Configuration of the SAP Router (S)
|
|
|
---------+ APP.4.2.A16 Implementation of Security Requirements for the Windows Operating System (S)
|
|
|
---------+ APP.4.2.A17 Implementation of Security Requirements for the Unix Operating System (S)
|
|
|
---------+ APP.4.2.A18 Disabling Insecure Communications (S)
|
|
|
---------+ APP.4.2.A19 Definition of Security Policies for Users (S)
|
|
|
---------+ APP.4.2.A20 Secure SAP GUI Settings (S)
|
|
|
---------+ APP.4.2.A22 Protection of the Spool in the SAP ERP System [Developer] (S)
|
|
|
---------+ APP.4.2.A23 Protection of SAP Background Processing [Developer] (S)
|
|
|
---------+ APP.4.2.A24 Activation and Protection of the Internet Communication Framework (S)
|
|
|
---------+ APP.4.2.A25 Secure Configuration of the SAP Web Dispatcher (S)
|
|
|
---------+ APP.4.2.A26 Protection of Customers' Own Code in the SAP ERP System (S)
|
|
|
---------+ APP.4.2.A27 Auditing the SAP ERP System [Department] (S)
|
|
|
---------+ APP.4.2.A28 Creation of a Contingency Concept [BCM Officer] (S)
|
|
|
---------+ APP.4.2.A29 Setting Up Emergency Users (S)
|
|
|
---------+ APP.4.2.A30 Implementation of Continuous Monitoring of Security Settings (S)
|
|
|
---------+ APP.4.2.A31 Configuration of SAP Single Sign-On (S)
|
|
|
---------+ APP.4.2.A32 Real-Time Detection and Alerts for Irregular Processes (H)
|
|
|
------+ APP.4.3 Relational Database Systems
|
|
|
---------+ APP.4.3.G1. Insufficient System Resources
|
|
|
---------+ APP.4.3.G2. Enabled Default User Accounts
|
|
|
---------+ APP.4.3.G3. Unencrypted Database Connections
|
|
|
---------+ APP.4.3.G4. Data Loss in a Database
|
|
|
---------+ APP.4.3.G5. Loss of Integrity of Stored Data
|
|
|
---------+ APP.4.3.G6. SQL Injections
|
|
|
---------+ APP.4.3.G7. Insecure Configuration of the Database Management System
|
|
|
---------+ APP.4.3.G8. Malware and Insecure Database Scripts
|
|
|
---------+ APP.4.3.A1 Creation of a Security Policy for Database Systems (B)
|
|
|
---------+ APP.4.3.A3 Basic Hardening of Database Management Systems (B)
|
|
|
---------+ APP.4.3.A4 Controlled Creation of New Databases (B)
|
|
|
---------+ APP.4.3.A9 Backing Up a Database System (B)
|
|
|
---------+ APP.4.3.A11 Sufficient Hardware Capacity [Process Owner] (S)
|
|
|
---------+ APP.4.3.A12 Uniform Configuration Standard for Database Management Systems (S)
|
|
|
---------+ APP.4.3.A13 Restrictive Utilisation of Database Links (S)
|
|
|
---------+ APP.4.3.A16 Encryption of Database Connections (S)
|
|
|
---------+ APP.4.3.A17 Data Transfer or Migration [Process Owner] (S)
|
|
|
---------+ APP.4.3.A18 Database Management System Monitoring (S)
|
|
|
---------+ APP.4.3.A19 Protection Against Malicious Database Scripts [Developer] (S)
|
|
|
---------+ APP.4.3.A20 Regular Audits (S)
|
|
|
---------+ APP.4.3.A21 Use of Database Security Tools (H)
|
|
|
---------+ APP.4.3.A22 Contingency Planning (H)
|
|
|
---------+ APP.4.3.A23 Archiving (H)
|
|
|
---------+ APP.4.3.A24 Data Encryption in Databases (H)
|
|
|
---------+ APP.4.3.A25 Security Audits of Database Systems (H)
|
|
|
------+ APP.4.4 Kubernetes
|
|
|
---------+ APP.4.4.G1. Poor Authentication and Authorisation in the Control Plane
|
|
|
---------+ APP.4.4.G2. Loss of Confidentiality of Access Data
|
|
|
---------+ APP.4.4.G3. Resource Conflicts on Nodes
|
|
|
---------+ APP.4.4.G4. Unauthorised Changes to Clusters
|
|
|
---------+ APP.4.4.G5. Unauthorised Communication
|
|
|
---------+ APP.4.4.A1 Planning the Separation of the Applications (B)
|
|
|
---------+ APP.4.4.A2 Planning Automation with CI/CD (B)
|
|
|
---------+ APP.4.4.A3 Identity and Access Management for Kubernetes (B)
|
|
|
---------+ APP.4.4.A4 Separation of Pods (B)
|
|
|
---------+ APP.4.4.A5 Backup in the Cluster (B)
|
|
|
---------+ APP.4.4.A6 Initialisation of Pods (S)
|
|
|
---------+ APP.4.4.A7 Separation of Networks for Kubernetes (S)
|
|
|
---------+ APP.4.4.A8 Securing Configuration Files on Kubernetes (S)
|
|
|
---------+ APP.4.4.A9 Use of Kubernetes Service Accounts (S)
|
|
|
---------+ APP.4.4.A10 Securing Automation Processes (S)
|
|
|
---------+ APP.4.4.A11 Container Monitoring (S)
|
|
|
---------+ APP.4.4.A12 Securing Infrastructure Applications (S)
|
|
|
---------+ APP.4.4.A13 Automated Configuration Auditing (H)
|
|
|
---------+ APP.4.4.A14 Use of Dedicated Nodes (H)
|
|
|
---------+ APP.4.4.A15 Separation of Applications at Node and Cluster Level (H)
|
|
|
---------+ APP.4.4.A16 Use of Operators (H)
|
|
|
---------+ APP.4.4.A17 Attestation of Nodes (H)
|
|
|
---------+ APP.4.4.A18 Use of Micro-Segmentation (H)
|
|
|
---------+ APP.4.4.A19 High Availability of Kubernetes (H)
|
|
|
---------+ APP.4.4.A20 Encrypted Data Storage for Pods (H)
|
|
|
---------+ APP.4.4.A21 Regular Restart of Pods (H)
|
|
|
------+ APP.4.6 SAP ABAP Programming
|
|
|
---------+ APP.4.6.G1. Lack of Authorisation Checks
|
|
|
---------+ APP.4.6.G2. Loss of Confidentiality or Integrity of Critical Data
|
|
|
---------+ APP.4.6.G3. Injection Vulnerabilities
|
|
|
---------+ APP.4.6.G4. Bypassing Existing SAP Security Mechanisms
|
|
|
---------+ APP.4.6.A1 Protecting Reports with Authorisation Checks (B)
|
|
|
---------+ APP.4.6.A2 Formally Correct Evaluation of Authorisation Checks (B)
|
|
|
---------+ APP.4.6.A3 Authorisation Check Before Starting a Transaction (B)
|
|
|
---------+ APP.4.6.A4 No Proprietary Authorisation Checks (B)
|
|
|
---------+ APP.4.6.A5 Drawing Up a Policy for ABAP Development (S)
|
|
|
---------+ APP.4.6.A6 Complete Execution of Authorisation Checks (S)
|
|
|
---------+ APP.4.6.A7 Authorisation Check During Input Processing (S)
|
|
|
---------+ APP.4.6.A8 Protection Against Unauthorised or Manipulative Access to the File System (S)
|
|
|
---------+ APP.4.6.A9 Authorisation Check in Remote-Enabled Function Modules (S)
|
|
|
---------+ APP.4.6.A10 Execution of Operating System Commands (S)
|
|
|
---------+ APP.4.6.A11 Avoiding Planted Malicious Code (S)
|
|
|
---------+ APP.4.6.A12 Avoiding Generic Module Execution (S)
|
|
|
---------+ APP.4.6.A13 Avoiding Generic Access to Table Contents (S)
|
|
|
---------+ APP.4.6.A14 Avoiding Native SQL Statements (S)
|
|
|
---------+ APP.4.6.A15 Avoiding Data Leaks (S)
|
|
|
---------+ APP.4.6.A16 No System-Dependent Execution of Functions (S)
|
|
|
---------+ APP.4.6.A17 No Client-Dependent Execution of Functions (S)
|
|
|
---------+ APP.4.6.A18 Avoiding Open SQL Injection Vulnerabilities (S)
|
|
|
---------+ APP.4.6.A19 Protection Against Cross-Site Scripting (S)
|
|
|
---------+ APP.4.6.A20 No Access to Data from Another Client (S)
|
|
|
---------+ APP.4.6.A21 Ban on Hidden ABAP Source Code (S)
|
|
|
---------+ APP.4.6.A22 Use of ABAP Code Analysis Tools (H)
|
|
|
------+ APP.5.2 Microsoft Exchange and Outlook
|
|
|
---------+ APP.5.2.G1. Insufficient Rules for Exchange and Outlook
|
|
|
---------+ APP.5.2.G2. Incorrect Migration of Exchange
|
|
|
---------+ APP.5.2.G3. Inadmissible Browser Access to Exchange
|
|
|
---------+ APP.5.2.G4. Unauthorised Connection of Other Systems to Exchange
|
|
|
---------+ APP.5.2.G5. Improper Administration of Site and Data Access Rights in Exchange and Outlook
|
|
|
---------+ APP.5.2.G6. Incorrect Configuration of Exchange
|
|
|
---------+ APP.5.2.G7. Improper Configuration of Outlook
|
|
|
---------+ APP.5.2.G8. Malfunction and Misuse of In-House Macros and Programming Interfaces in Outlook
|
|
|
---------+ APP.5.2.A1 Planning the Use of Exchange and Outlook (B)
|
|
|
---------+ APP.5.2.A2 Selecting an Exchange Infrastructure (B)
|
|
|
---------+ APP.5.2.A3 Access Management and Access Rights (B)
|
|
|
---------+ APP.5.2.A5 Backing Up Exchange (B)
|
|
|
---------+ APP.5.2.A7 Migration of Exchange Systems (S)
|
|
|
---------+ APP.5.2.A9 Secure Configuration of Exchange Servers (S)
|
|
|
---------+ APP.5.2.A10 Secure Configuration of Outlook (S)
|
|
|
---------+ APP.5.2.A11 Protection of Communications Between Exchange Systems (S)
|
|
|
---------+ APP.5.2.A12 Using Outlook Anywhere, MAPI over HTTP, and Outlook on the Web (S)
|
|
|
---------+ APP.5.2.A17 Encryption of Exchange Database Files (H)
|
|
|
------+ APP.5.3 General E-Mail Clients and Servers
|
|
|
---------+ APP.5.3.G1. Insufficient Planning of E-Mail Use
|
|
|
---------+ APP.5.3.G2. Incorrect Configuration of E-Mail Clients and Servers
|
|
|
---------+ APP.5.3.G3. E-mail Unreliability
|
|
|
---------+ APP.5.3.G4. Malware in E-Mails
|
|
|
---------+ APP.5.3.G5. Social engineering
|
|
|
---------+ APP.5.3.G6. Reading and Manipulating E-Mails
|
|
|
---------+ APP.5.3.A1 Secure Configuration of E-Mail Clients (B)
|
|
|
---------+ APP.5.3.A2 Secure Operation of E-Mail Servers (B)
|
|
|
---------+ APP.5.3.A3 Data Backup and Archiving of E-Mails (B)
|
|
|
---------+ APP.5.3.A4 Spam and Virus Protection on E-Mail Servers (B)
|
|
|
---------+ APP.5.3.A5 Establishing Deputising Rules for E-Mail Use [Supervisor] (S)
|
|
|
---------+ APP.5.3.A6 Defining a Security Policy for E-Mail (S)
|
|
|
---------+ APP.5.3.A7 User Training on the Security Mechanisms of E-Mail Clients (S)
|
|
|
---------+ APP.5.3.A8 Training Users to Deal with Spam [User] (S)
|
|
|
---------+ APP.5.3.A9 Extended Security Safeguards on E-Mail Servers (S)
|
|
|
---------+ APP.5.3.A10 End-to-End Encryption (H)
|
|
|
---------+ APP.5.3.A11 Deployment of Redundant E-Mail Servers (H)
|
|
|
---------+ APP.5.3.A12 Monitoring Public Blacklists (H)
|
|
|
---------+ APP.5.3.A13 TLS Reporting (H)
|
|
|
------+ APP.6 General Software
|
|
|
---------+ APP.6.G1. Inappropriate Selection of Software
|
|
|
---------+ APP.6.G2. Disclosure of Sensitive Information Due to Incorrect Configuration
|
|
|
---------+ APP.6.G3. Purchasing Software from Unreliable Sources
|
|
|
---------+ APP.6.G4. Security Vulnerabilities Due to Inadequate Maintenance
|
|
|
---------+ APP.6.G5. Data Loss Due to Incorrect Use of Software
|
|
|
---------+ APP.6.G6. Insufficient Resources for Running Software
|
|
|
---------+ APP.6.G7. Failure to Meet User Requirements
|
|
|
---------+ APP.6.A1 Planning Software Use [Process Owner] (B)
|
|
|
---------+ APP.6.A2 Drawing Up a Requirements Catalogue for Software [Process Owner] (B)
|
|
|
---------+ APP.6.A3 Secure Procurement of Software [Procurement Department] (B)
|
|
|
---------+ APP.6.A4 Regulation of Software Installation and Configuration [Process Owner] (B)
|
|
|
---------+ APP.6.A5 Secure Installation of Software (B)
|
|
|
---------+ APP.6.A6 Consideration of Recommended Security Requirements (S)
|
|
|
---------+ APP.6.A7 Selection and Assessment of Potential Software [Process Owner, Procurement Department] (S)
|
|
|
---------+ APP.6.A8 Regulation of the Availability of Installation Files (S)
|
|
|
---------+ APP.6.A9 Taking Inventory of Software (S)
|
|
|
---------+ APP.6.A10 Establishing a Security Policy for Software Use (S)
|
|
|
---------+ APP.6.A11 Using Plug-ins and Extensions (S)
|
|
|
---------+ APP.6.A12 Orderly Decommissioning of Software [Process Owner] (S)
|
|
|
---------+ APP.6.A13 Uninstallation of Software (S)
|
|
|
---------+ APP.6.A14 Using Certified Software (H)
|
|
|
------+ APP.7 Development of Individual Software
|
|
|
---------+ APP.7.G1. Unsatisfactory Contractual Arrangements with External Service Providers
|
|
|
---------+ APP.7.G2. Software Design Errors
|
|
|
---------+ APP.7.G3. Undocumented Functions
|
|
|
---------+ APP.7.G4. Insufficient Security Safeguards in Applications
|
|
|
---------+ APP.7.G5. Inadequate Control of Software Development
|
|
|
---------+ APP.7.G6. Hiring Unsuitable Software Developers
|
|
|
---------+ APP.7.A1 Including Aspects of Individual Software in Software Deployment Planning (B)
|
|
|
---------+ APP.7.A2 Defining Security Requirements for the Software Development Process (B)
|
|
|
---------+ APP.7.A3 Specification of Security Functions for System Integration [IT Operation Department] (B)
|
|
|
---------+ APP.7.A4 Commissioning in Line with Requirements [Procurement Department] (B)
|
|
|
---------+ APP.7.A5 Appropriate Control of Application Development (S)
|
|
|
---------+ APP.7.A6 Documentation of Individual Software Requirements (S)
|
|
|
---------+ APP.7.A7 Secure Acquisition of Individual Software (S)
|
|
|
---------+ APP.7.A8 Early Involvement of the Process Owner in Development-Related Software Tests (S)
|
|
|
---------+ APP.7.A9 Trusted Storage (H)
|
|
|
---------+ APP.7.A10 Commissioning Certified Software Development Companies (H)
|
|
|
---+ IT Systems
|
|
|
------+ SYS.1.1 General Server
|
|
|
---------+ SYS.1.1.G1. Data Loss
|
|
|
---------+ SYS.1.1.G2. Denial-of-Service Attacks
|
|
|
---------+ SYS.1.1.G3. Provision of Unnecessary Operating System Components and Applications
|
|
|
---------+ SYS.1.1.G4. Server Overload
|
|
|
---------+ SYS.1.1.A1 Appropriate Installation (B)
|
|
|
---------+ SYS.1.1.A2 User Authentication on Servers (B)
|
|
|
---------+ SYS.1.1.A5 Protection of Interfaces (B)
|
|
|
---------+ SYS.1.1.A6 Disabling Unnecessary Services (B)
|
|
|
---------+ SYS.1.1.A9 Using Anti-Virus Programs on Servers (B)
|
|
|
---------+ SYS.1.1.A10 Logging (B)
|
|
|
---------+ SYS.1.1.A11 Defining a Security Policy for Servers (S)
|
|
|
---------+ SYS.1.1.A12 Planning the Use of Servers (S)
|
|
|
---------+ SYS.1.1.A13 Procurement of Servers (S)
|
|
|
---------+ SYS.1.1.A15 Stable and Uninterruptible Power Supply [Building Services] (S)
|
|
|
---------+ SYS.1.1.A16 Secure Basic Configuration of Servers (S)
|
|
|
---------+ SYS.1.1.A19 Configuring Local Packet Filters (S)
|
|
|
---------+ SYS.1.1.A21 Operational Documentation for Servers (S)
|
|
|
---------+ SYS.1.1.A22 Integration into Contingency Planning (S)
|
|
|
---------+ SYS.1.1.A23 Monitoring Systems and Servers (S)
|
|
|
---------+ SYS.1.1.A24 Security Checks for Servers (S)
|
|
|
---------+ SYS.1.1.A25 Controlled Decommissioning of a Server (S)
|
|
|
---------+ SYS.1.1.A35 Drawing Up and Maintaining an Operating Manual (S)
|
|
|
---------+ SYS.1.1.A37 Encapsulation of Security-Critical Applications and Operating System Components (S)
|
|
|
---------+ SYS.1.1.A27 Host-Based Attack Detection (H)
|
|
|
---------+ SYS.1.1.A28 Increasing Availability Through Redundancy (H)
|
|
|
---------+ SYS.1.1.A30 One Service per Server (H)
|
|
|
---------+ SYS.1.1.A31 Using Execution Control (H)
|
|
|
---------+ SYS.1.1.A33 Active Administration of Root Certificates (H)
|
|
|
---------+ SYS.1.1.A34 Hard Disk Encryption (H)
|
|
|
---------+ SYS.1.1.A36 Protecting the Boot Process (H)
|
|
|
---------+ SYS.1.1.A38 Hardening of the Host System by Means of a Read-Only File System (H)
|
|
|
------+ SYS.1.2.2 Windows Server 2012
|
|
|
---------+ SYS.1.2.2.G1. Poor Planning of Windows Server 2012
|
|
|
---------+ SYS.1.2.2.G2. Careless Cloud usage
|
|
|
---------+ SYS.1.2.2.G3. Improper Administration of Windows Servers
|
|
|
---------+ SYS.1.2.2.G4. Improper Use of Group Policies (GPOs)
|
|
|
---------+ SYS.1.2.2.G5. Loss of Integrity of Sensitive Information or Processes
|
|
|
---------+ SYS.1.2.2.G6. Unauthorised Acquisition or Misuse of Administrator Rights
|
|
|
---------+ SYS.1.2.2.G7. Compromised Remote Access
|
|
|
---------+ SYS.1.2.2.A1 Planning of Windows Server 2012 (B)
|
|
|
---------+ SYS.1.2.2.A2 Secure Installation of Windows Server 2012 (B)
|
|
|
---------+ SYS.1.2.2.A3 Secure Administration of Windows Server 2012 (B)
|
|
|
---------+ SYS.1.2.2.A4 Secure Configuration of Windows Server 2012 (S)
|
|
|
---------+ SYS.1.2.2.A5 Protection Against Malware on Windows Server 2012 (S)
|
|
|
---------+ SYS.1.2.2.A6 Secure Authentication and Authorisation in Windows Server 2012 (S)
|
|
|
---------+ SYS.1.2.2.A8 Protection of System Integrity (S)
|
|
|
---------+ SYS.1.2.2.A11 Attack Detection in Windows Server 2012 (H)
|
|
|
---------+ SYS.1.2.2.A12 Redundancy and High Availability in Windows Server 2012 (H)
|
|
|
---------+ SYS.1.2.2.A14 Shutting Down Encrypted Servers and Virtual Machines (H)
|
|
|
------+ SYS.1.3 Linux and Unix Servers
|
|
|
---------+ SYS.1.3.G1. Unauthorised Collection of System and User Information
|
|
|
---------+ SYS.1.3.G2. Exploitability of the Script Environment
|
|
|
---------+ SYS.1.3.G3. Dynamic Loading of Jointly Used Libraries
|
|
|
---------+ SYS.1.3.G4. Software from Third-Party Sources
|
|
|
---------+ SYS.1.3.A2 Careful Allocation of IDs (B)
|
|
|
---------+ SYS.1.3.A3 No Automatic Integration of Removable Drives (B)
|
|
|
---------+ SYS.1.3.A4 Protection from Exploitation of Vulnerabilities in Applications (B)
|
|
|
---------+ SYS.1.3.A5 Secure Installation of Software Packages (B)
|
|
|
---------+ SYS.1.3.A6 Managing Users and Groups (S)
|
|
|
---------+ SYS.1.3.A8 Encrypted Access via Secure Shell (S)
|
|
|
---------+ SYS.1.3.A10 Preventing Further Intrusion When Vulnerabilities Are Exploited (S)
|
|
|
---------+ SYS.1.3.A14 Preventing Unauthorised Collection of System and User Information (H)
|
|
|
---------+ SYS.1.3.A16 Additional Prevention of Further Intrusion When Vulnerabilities Are Exploited (H)
|
|
|
---------+ SYS.1.3.A17 Additional Kernel Protection (H)
|
|
|
------+ SYS.1.5 Virtualisation
|
|
|
---------+ SYS.1.5.G1. Poor Planning of Virtualisation
|
|
|
---------+ SYS.1.5.G2. Poor Configuration of Virtualisation
|
|
|
---------+ SYS.1.5.G3. Insufficient Resources for Virtual IT Systems
|
|
|
---------+ SYS.1.5.G4. Information Leaks or Resource Bottlenecks due to Snapshots
|
|
|
---------+ SYS.1.5.G5. Failure of the Administration Server for Virtualisation Systems
|
|
|
---------+ SYS.1.5.G6. Misuse of Guest Tools
|
|
|
---------+ SYS.1.5.G7. Compromised Virtualisation Software
|
|
|
---------+ SYS.1.5.A2 Secure Use of Virtual IT Systems (B)
|
|
|
---------+ SYS.1.5.A3 Secure Configuration of Virtual IT Systems (B)
|
|
|
---------+ SYS.1.5.A4 Secure Configuration of a Network for Virtual Infrastructures (B)
|
|
|
---------+ SYS.1.5.A5 Protection of Administration Interfaces (B)
|
|
|
---------+ SYS.1.5.A6 Logging in the Virtual Infrastructure (B)
|
|
|
---------+ SYS.1.5.A7 Time Synchronisation in Virtual IT Systems (B)
|
|
|
---------+ SYS.1.5.A8 Planning a Virtual Infrastructure [Planner] (S)
|
|
|
---------+ SYS.1.5.A9 Network Planning for Virtual Infrastructure [Planner] (S)
|
|
|
---------+ SYS.1.5.A10 Introduction of Management Processes for Virtual IT Systems (S)
|
|
|
---------+ SYS.1.5.A11 Administration of the Virtualisation Infrastructure Using a Separate Management Network (S)
|
|
|
---------+ SYS.1.5.A12 Rights and Role Concept for Virtual Infrastructure Administration (S)
|
|
|
---------+ SYS.1.5.A13 Selection of Suitable Hardware for Virtualisation Environments (S)
|
|
|
---------+ SYS.1.5.A14 Uniform Configuration Standards for Virtual IT Systems (S)
|
|
|
---------+ SYS.1.5.A15 Operation of Guest Operating Systems with Different Protection Needs (S)
|
|
|
---------+ SYS.1.5.A16 Encapsulation of Virtual Machines (S)
|
|
|
---------+ SYS.1.5.A17 Monitoring the Operating Condition and Configuration of the Virtual Infrastructure (S)
|
|
|
---------+ SYS.1.5.A19 Regular Audits of Virtualisation Infrastructure (S)
|
|
|
---------+ SYS.1.5.A20 Using Highly Available Architectures [Planner] (H)
|
|
|
---------+ SYS.1.5.A21 Secure Configuration of Virtual IT Systems for Increased Protection Needs (H)
|
|
|
---------+ SYS.1.5.A22 Hardening of the Virtualisation Server (H)
|
|
|
---------+ SYS.1.5.A23 Restriction of Rights of Virtual Machines (H)
|
|
|
---------+ SYS.1.5.A24 Disabling Snapshots of Virtual IT Systems (H)
|
|
|
---------+ SYS.1.5.A25 Minimal Use of Console Access to Virtual IT Systems (H)
|
|
|
---------+ SYS.1.5.A26 Use of a PKI [Planner] (H)
|
|
|
---------+ SYS.1.5.A27 Use of Certified Virtualisation Software (H)
|
|
|
---------+ SYS.1.5.A28 Encryption of Virtual IT Systems (H)
|
|
|
------+ SYS.1.6 Containerisation
|
|
|
---------+ SYS.1.6.G1. Vulnerabilities or Malware in Images
|
|
|
---------+ SYS.1.6.G2. Administrative Access Without Security
|
|
|
---------+ SYS.1.6.G3. Resource Conflicts on the Host
|
|
|
---------+ SYS.1.6.G4. Unauthorised Communication
|
|
|
---------+ SYS.1.6.G5. Breaking Out of the Container into the Host System
|
|
|
---------+ SYS.1.6.G6. Data Loss Through Container Management
|
|
|
---------+ SYS.1.6.G7. Loss of Confidentiality of Access Data
|
|
|
---------+ SYS.1.6.G8. Disorderly Provision and Distribution of Images
|
|
|
---------+ SYS.1.6.A1 Planning Container Use (B)
|
|
|
---------+ SYS.1.6.A2 Container Management Planning (B)
|
|
|
---------+ SYS.1.6.A3 Secure Use of Containerised IT Systems (B)
|
|
|
---------+ SYS.1.6.A4 Planning the Provision and Distribution of Images (B)
|
|
|
---------+ SYS.1.6.A5 Separation of Administration and Access Networks for Containers (B)
|
|
|
---------+ SYS.1.6.A6 Use of Secure Images (B)
|
|
|
---------+ SYS.1.6.A7 Persistence of Container Logging Data (B)
|
|
|
---------+ SYS.1.6.A8 Secure Storage of Container Access Data (B)
|
|
|
---------+ SYS.1.6.A9 Suitability for Container Operation (S)
|
|
|
---------+ SYS.1.6.A10 Policy for Images and Container Operation (S)
|
|
|
---------+ SYS.1.6.A11 Only One Service per Container (S)
|
|
|
---------+ SYS.1.6.A12 Distribution of Secure Images (S)
|
|
|
---------+ SYS.1.6.A13 Release of Images (S)
|
|
|
---------+ SYS.1.6.A14 Updating Images (S)
|
|
|
---------+ SYS.1.6.A15 Limitation of Resources per Container (S)
|
|
|
---------+ SYS.1.6.A16 Administrative Remote Access to Containers (S)
|
|
|
---------+ SYS.1.6.A17 Running Containers Without Privileges (S)
|
|
|
---------+ SYS.1.6.A18 Application Services Accounts (S)
|
|
|
---------+ SYS.1.6.A19 Including Data Stores in Containers (S)
|
|
|
---------+ SYS.1.6.A20 Protection of Configuration Data (S)
|
|
|
---------+ SYS.1.6.A21 Extended Security Policies (H)
|
|
|
---------+ SYS.1.6.A22 Provision for Investigations (H)
|
|
|
---------+ SYS.1.6.A23 Container Immutability (H)
|
|
|
---------+ SYS.1.6.A24 Host-Based Attack Detection (H)
|
|
|
---------+ SYS.1.6.A25 High Availability of Containerised Applications (H)
|
|
|
---------+ SYS.1.6.A26 Advanced Isolation and Encapsulation of Containers (H)
|
|
|
------+ SYS.1.7 IBM Z
|
|
|
---------+ SYS.1.7.G1. Inadequate or Incorrect Configuration of Hardware or the z/OS Operating System
|
|
|
---------+ SYS.1.7.G2. Incorrect Configuration of the z/OS Security System RACF
|
|
|
---------+ SYS.1.7.G3. Incorrect Use of z/OS System Functions
|
|
|
---------+ SYS.1.7.G4. Manipulation of the z/OS System Configuration
|
|
|
---------+ SYS.1.7.G5. Attacks on z/OS Systems Using TCP/IP
|
|
|
---------+ SYS.1.7.G6. Incorrect Character Conversion When Using z/OS
|
|
|
---------+ SYS.1.7.A1 Use of Restrictive z/OS IDs (B)
|
|
|
---------+ SYS.1.7.A2 Protection of Security-Critical z/OS Utilities (B)
|
|
|
---------+ SYS.1.7.A3 Maintenance of Z Systems (B)
|
|
|
---------+ SYS.1.7.A4 Training z/OS Operators [Supervisor] (B)
|
|
|
---------+ SYS.1.7.A5 Use and Protection of System-Related z/OS Terminals (B)
|
|
|
---------+ SYS.1.7.A6 Use and Protection of the Remote Support Facility (B)
|
|
|
---------+ SYS.1.7.A7 Restrictive Authorisation in z/OS (B)
|
|
|
---------+ SYS.1.7.A8 Use of the z/OS Security System RACF (B)
|
|
|
---------+ SYS.1.7.A9 Multi-Client Capability in z/OS (B)
|
|
|
---------+ SYS.1.7.A11 Protection of Session Data (B)
|
|
|
---------+ SYS.1.7.A14 Reporting on the Secure Operation of z/OS (S)
|
|
|
---------+ SYS.1.7.A16 Monitoring of z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A17 Synchronisation of z/OS Passwords and RACF Commands (S)
|
|
|
---------+ SYS.1.7.A18 Role Concept for z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A19 Protection of z/OS Transaction Monitors (S)
|
|
|
---------+ SYS.1.7.A20 Decommissioning z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A21 Protection of the Startup Process of z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A22 Protection of the Operating Functions of z/OS (S)
|
|
|
---------+ SYS.1.7.A23 Protection of z/VM (S)
|
|
|
---------+ SYS.1.7.A24 Administration of Storage Media in z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A25 Stipulation of z/OS System Capacity (S)
|
|
|
---------+ SYS.1.7.A26 Workload Management for z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A27 Character Set Conversion in z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A28 Licence Key Management for z/OS Software (S)
|
|
|
---------+ SYS.1.7.A29 Protection of Unix System Services on z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A30 Protection of the z/OS Trace Functions (S)
|
|
|
---------+ SYS.1.7.A31 Contingency Planning for z/OS Systems (S)
|
|
|
---------+ SYS.1.7.A32 Determining Standards for z/OS System Definitions (H)
|
|
|
---------+ SYS.1.7.A33 Separation of Test and Production Systems in z/OS (H)
|
|
|
---------+ SYS.1.7.A34 Batch Job Planning for z/OS Systems (H)
|
|
|
---------+ SYS.1.7.A35 Use of RACF Exits (H)
|
|
|
---------+ SYS.1.7.A36 Internal Communication Between Operating Systems (H)
|
|
|
---------+ SYS.1.7.A37 Parallel Sysplex in z/OS (H)
|
|
|
---------+ SYS.1.7.A38 Use of the VTAM Session Management Exit in z/OS (H)
|
|
|
------+ SYS.1.8 Storage Solutions
|
|
|
---------+ SYS.1.8.G1. Insecure Default Settings of Storage Components
|
|
|
---------+ SYS.1.8.G2. Manipulation of Data via the Storage System
|
|
|
---------+ SYS.1.8.G3. Loss of Confidentiality due to Storage-Based Replication Methods
|
|
|
---------+ SYS.1.8.G4. Access to Information of Other Clients Using WWN Spoofing
|
|
|
---------+ SYS.1.8.G5. Bypassing Logical Network Separation
|
|
|
---------+ SYS.1.8.G6. Failure of Storage Solution Components
|
|
|
---------+ SYS.1.8.G7. Obtaining Physical Access to SAN Switches
|
|
|
---------+ SYS.1.8.A1 Appropriate Installation of Storage Systems [Building Services] (B)
|
|
|
---------+ SYS.1.8.A2 Secure Basic Configuration of Storage Solutions (B)
|
|
|
---------+ SYS.1.8.A4 Protection of Administration Interfaces (B)
|
|
|
---------+ SYS.1.8.A6 Creation of a Security Policy for Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A7 Planning of Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A8 Selecting an Appropriate Storage Solution (S)
|
|
|
---------+ SYS.1.8.A9 Selection of Suppliers for a Storage Solution (S)
|
|
|
---------+ SYS.1.8.A10 Drawing Up and Maintaining an Operating Manual (S)
|
|
|
---------+ SYS.1.8.A11 Secure Operation of a Storage Solution (S)
|
|
|
---------+ SYS.1.8.A13 Monitoring and Administration of Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A14 Protection of an SAN Through Segmentation (S)
|
|
|
---------+ SYS.1.8.A15 Secure Separation of Clients in Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A16 Secure Deletion in SAN Environments (S)
|
|
|
---------+ SYS.1.8.A17 Documenting Storage System Settings (S)
|
|
|
---------+ SYS.1.8.A18 Security Audits and Reporting Storage Systems (S)
|
|
|
---------+ SYS.1.8.A19 Decommissioning Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A20 Contingency Planning and Emergency Response for Storage Solutions (S)
|
|
|
---------+ SYS.1.8.A21 Use of Storage Pools in Client Separation (H)
|
|
|
---------+ SYS.1.8.A22 Use of a High Availability SAN Solution (H)
|
|
|
---------+ SYS.1.8.A23 Use of Encryption for Storage Solutions (H)
|
|
|
---------+ SYS.1.8.A24 Ensuring the Integrity of the SAN Fabric (H)
|
|
|
---------+ SYS.1.8.A25 Multiple Overwrites of LUN Data (H)
|
|
|
---------+ SYS.1.8.A26 Securing a SAN with Hard Zoning (H)
|
|
|
------+ SYS.2.1 General Client
|
|
|
---------+ SYS.2.1.G1. Malware
|
|
|
---------+ SYS.2.1.G2. Data Loss Due to Local Data Storage
|
|
|
---------+ SYS.2.1.G3. Hardware Defects in Client Systems
|
|
|
---------+ SYS.2.1.G4. Unauthorised Use of IT
|
|
|
---------+ SYS.2.1.G5. Installation of Unnecessary Operating System Components and Applications
|
|
|
---------+ SYS.2.1.G6. Eavesdropping on Rooms Using Microphones and Cameras
|
|
|
---------+ SYS.2.1.G7. Incorrect Administration or Use of Devices and Systems
|
|
|
---------+ SYS.2.1.A1 Secure User Authorisation (B)
|
|
|
---------+ SYS.2.1.A3 Activation of Automatic Update Mechanisms (B)
|
|
|
---------+ SYS.2.1.A6 Using Malware Protection Programs (B)
|
|
|
---------+ SYS.2.1.A8 Protecting the Boot Process (B)
|
|
|
---------+ SYS.2.1.A42 Use of Cloud and Online Functions [User] (B)
|
|
|
---------+ SYS.2.1.A9 Defining a Security Policy for Clients (S)
|
|
|
---------+ SYS.2.1.A10 Planning the Use of Clients (S)
|
|
|
---------+ SYS.2.1.A11 Procurement of Clients (S)
|
|
|
---------+ SYS.2.1.A13 Access to Runtime Environments with Unmonitored Code Execution (S)
|
|
|
---------+ SYS.2.1.A14 Updates and Patches for Firmware, Operating Systems, and Applications (S)
|
|
|
---------+ SYS.2.1.A15 Secure Installation and Configuration of Clients (S)
|
|
|
---------+ SYS.2.1.A16 Disabling and Removing Unnecessary Components and IDs (S)
|
|
|
---------+ SYS.2.1.A18 Using Encrypted Communication (S)
|
|
|
---------+ SYS.2.1.A20 Protecting the Administration Process for Clients (S)
|
|
|
---------+ SYS.2.1.A21 Preventing Unauthorised Use of Computer Microphones and Cameras (S)
|
|
|
---------+ SYS.2.1.A23 Preferences for Client-Server Services (S)
|
|
|
---------+ SYS.2.1.A24 Dealing with External and Removable Media (S)
|
|
|
---------+ SYS.2.1.A26 Protection Against Exploitation of Vulnerabilities in Applications (S)
|
|
|
---------+ SYS.2.1.A27 Orderly Decommissioning of Clients (S)
|
|
|
---------+ SYS.2.1.A34 Encapsulation of Security-Critical Applications and Operating System Components (H)
|
|
|
---------+ SYS.2.1.A43 Local Security Policy for Clients (S)
|
|
|
---------+ SYS.2.1.A44 Client Security Policy Management (S)
|
|
|
---------+ SYS.2.1.A28 Encryption of Clients (H)
|
|
|
---------+ SYS.2.1.A29 System and Client Monitoring (S)
|
|
|
---------+ SYS.2.1.A30 Setting Up a Reference Environment for Clients (H)
|
|
|
---------+ SYS.2.1.A31 Configuring Local Packet Filters (H)
|
|
|
---------+ SYS.2.1.A32 Use of Additional Safeguards to Protect Against Exploits (H)
|
|
|
---------+ SYS.2.1.A33 Using Execution Control (H)
|
|
|
---------+ SYS.2.1.A35 Active Administration of Root Certificates (H)
|
|
|
---------+ SYS.2.1.A36 Self-Managed Use of SecureBoot and TPM (H)
|
|
|
---------+ SYS.2.1.A37 Use of Multi-Factor Authentication (H)
|
|
|
---------+ SYS.2.1.A38 Integration into Contingency Planning (H)
|
|
|
---------+ SYS.2.1.A39 Stable and Uninterruptible Power Supply [Building Services] (H)
|
|
|
---------+ SYS.2.1.A40 Operational Documentation (H)
|
|
|
---------+ SYS.2.1.A41 Use of Quotas for Local Media (H)
|
|
|
---------+ SYS.2.1.A45 Extended Logging (H)
|
|
|
------+ SYS.2.2.2 Windows 8.1 Clients
|
|
|
---------+ SYS.2.2.2.G1. Malware Designed for Windows
|
|
|
---------+ SYS.2.2.2.G2. Integrated Cloud Functions
|
|
|
---------+ SYS.2.2.2.G3. Impairment of Software Features due to Compatibility Issues
|
|
|
---------+ SYS.2.2.2.A1 Selecting a Suitable Windows 8.1 Version (B)
|
|
|
---------+ SYS.2.2.2.A2 Defining a Login Procedure for Windows 8.1 (B)
|
|
|
---------+ SYS.2.2.2.A3 Use of Virus Protection Programs with Windows 8.1 (B)
|
|
|
---------+ SYS.2.2.2.A4 Procurement of Windows 8.1 (S)
|
|
|
---------+ SYS.2.2.2.A5 Local Security Policy for Windows 8.1 (S)
|
|
|
---------+ SYS.2.2.2.A7 Use of Windows User Account Control (S)
|
|
|
---------+ SYS.2.2.2.A8 No Use of the Homegroup Feature [User] (S)
|
|
|
---------+ SYS.2.2.2.A9 Data Protection and Data Economy in Windows 8.1 Clients [User] (S)
|
|
|
---------+ SYS.2.2.2.A10 Integration of Online Accounts into the Operating System [User] (S)
|
|
|
---------+ SYS.2.2.2.A11 Configuration of Synchronisation Mechanisms in Windows 8.1 (S)
|
|
|
---------+ SYS.2.2.2.A12 Secure Central Authentication of Windows Networks (S)
|
|
|
---------+ SYS.2.2.2.A13 Connection of Windows 8.1 to the Microsoft Store (S)
|
|
|
---------+ SYS.2.2.2.A14 Application Control Using Software Restriction Policies and AppLocker (H)
|
|
|
---------+ SYS.2.2.2.A15 File System Encryption Using EFS (H)
|
|
|
---------+ SYS.2.2.2.A16 Use of Windows PowerShell (H)
|
|
|
---------+ SYS.2.2.2.A17 Secure Use of the Maintenance Centre (H)
|
|
|
---------+ SYS.2.2.2.A18 Activation of the Last Access Time Stamp (H)
|
|
|
---------+ SYS.2.2.2.A19 Use of Login Information Management (H)
|
|
|
---------+ SYS.2.2.2.A20 Security During Remote Access Using RDP (H)
|
|
|
---------+ SYS.2.2.2.A21 Use of File and Registry Virtualisation (H)
|
|
|
------+ SYS.2.2.3 Windows 10 Clients
|
|
|
---------+ SYS.2.2.3.G1. Malware in Windows 10
|
|
|
---------+ SYS.2.2.3.G2. Integrated Cloud Functions
|
|
|
---------+ SYS.2.2.3.G3. Impairment of Software Features Due to Compatibility Issues
|
|
|
---------+ SYS.2.2.3.G4. Telemetry Functions of Windows 10
|
|
|
---------+ SYS.2.2.3.G5. Restricted Forensics When Using the Virtual Secure Mode (VSM)
|
|
|
---------+ SYS.2.2.3.A1 Planning the Use of Cloud Services for Windows 10 (B)
|
|
|
---------+ SYS.2.2.3.A2 Selecting and Procuring a Suitable Windows 10 Version (B)
|
|
|
---------+ SYS.2.2.3.A4 Telemetry and Privacy Settings in Windows 10 (B)
|
|
|
---------+ SYS.2.2.3.A5 Protection Against Malware in Windows 10 (B)
|
|
|
---------+ SYS.2.2.3.A6 Integration of Online Accounts into the Operating System [User] (B)
|
|
|
---------+ SYS.2.2.3.A9 Secure Central Authentication of Windows Networks (S)
|
|
|
---------+ SYS.2.2.3.A12 File and Share Authorisation in Windows 10 (S)
|
|
|
---------+ SYS.2.2.3.A13 Using the SmartScreen Function (S)
|
|
|
---------+ SYS.2.2.3.A14 Use of the Voice Assistant Cortana [User] (S)
|
|
|
---------+ SYS.2.2.3.A15 Use of Synchronisation Mechanisms in Windows 10 (S)
|
|
|
---------+ SYS.2.2.3.A16 Connection of Windows 10 to the Microsoft Store (S)
|
|
|
---------+ SYS.2.2.3.A17 No Storage of Automatic Login Data (S)
|
|
|
---------+ SYS.2.2.3.A18 Use of Windows Remote Support (S)
|
|
|
---------+ SYS.2.2.3.A19 Security During Remote Access Using RDP [User] (S)
|
|
|
---------+ SYS.2.2.3.A20 Use of User Account Control (UAC) for Privileged Accounts (S)
|
|
|
---------+ SYS.2.2.3.A21 Use of the Encrypting File System (H)
|
|
|
---------+ SYS.2.2.3.A22 Use of Windows PowerShell (H)
|
|
|
---------+ SYS.2.2.3.A23 Advanced Protection of Login Information in Windows 10 (H)
|
|
|
---------+ SYS.2.2.3.A24 Activation of the Last Access Time Stamp (H)
|
|
|
---------+ SYS.2.2.3.A25 Handling Remote Access Features of Connected User Experience and Telemetry (H)
|
|
|
------+ SYS.2.3 Linux and Unix Clients
|
|
|
---------+ SYS.2.3.G1. Software from Third-Party Sources
|
|
|
---------+ SYS.2.3.G2. Exploitability of the Script Environment
|
|
|
---------+ SYS.2.3.G3. Dynamic Loading of Jointly Used Libraries
|
|
|
---------+ SYS.2.3.G4. Incorrect Configuration
|
|
|
---------+ SYS.2.3.A1 Authentication of Administrators and Users [User] (B)
|
|
|
---------+ SYS.2.3.A2 Selection of an Appropriate Distribution (B)
|
|
|
---------+ SYS.2.3.A4 Kernel Updates on Unix-Like Systems (B)
|
|
|
---------+ SYS.2.3.A5 Secure Installation of Software Packages (B)
|
|
|
---------+ SYS.2.3.A6 No Automatic Integration of Removable Drives [User] (S)
|
|
|
---------+ SYS.2.3.A7 Restrictive Granting of Access Rights for Files and Directories (S)
|
|
|
---------+ SYS.2.3.A8 Use of Techniques to Restrict the Rights of Applications (S)
|
|
|
---------+ SYS.2.3.A9 Secure Use of Passwords in the Command Line [User] (S)
|
|
|
---------+ SYS.2.3.A11 Preventing the Local Hard Drive From Becoming Overloaded (S)
|
|
|
---------+ SYS.2.3.A12 Secure Use of Appliances (S)
|
|
|
---------+ SYS.2.3.A14 Protection Against the Use of Unauthorised Peripheral Devices (H)
|
|
|
---------+ SYS.2.3.A15 Additional Protection Prior to Executing Undesired Files (H)
|
|
|
---------+ SYS.2.3.A17 Additional Prevention of Further Intrusion When Vulnerabilities Are Exploited (H)
|
|
|
---------+ SYS.2.3.A18 Additional Kernel Protection (H)
|
|
|
---------+ SYS.2.3.A19 Hard Disk or File Encryption (H)
|
|
|
---------+ SYS.2.3.A20 Disabling Critical SysRq Features (H)
|
|
|
------+ SYS.2.4 macOS Clients
|
|
|
---------+ SYS.2.4.G1. Uncontrolled Access to Outsourced Data
|
|
|
---------+ SYS.2.4.G2. Misuse of Apple IDs as Central Access Information for Apple Services
|
|
|
---------+ SYS.2.4.G3. Attacks on Wireless Interfaces
|
|
|
---------+ SYS.2.4.G4. Attacks on Applications with a Preview Function
|
|
|
---------+ SYS.2.4.G5. Insecure Protocols in macOS or macOS Applications
|
|
|
---------+ SYS.2.4.A1 Planning the Secure Use of macOS (B)
|
|
|
---------+ SYS.2.4.A2 Using the Security Functions Integrated into macOS (B)
|
|
|
---------+ SYS.2.4.A3 Use of Suitable User Accounts [User] (B)
|
|
|
---------+ SYS.2.4.A4 Use of Hard Drive Encryption (S)
|
|
|
---------+ SYS.2.4.A5 Disabling Security-Critical Functions in macOS (S)
|
|
|
---------+ SYS.2.4.A6 Using Up-To-Date Mac Hardware (S)
|
|
|
---------+ SYS.2.4.A7 Two-Factor Authentication for Apple IDs [User] (S)
|
|
|
---------+ SYS.2.4.A8 No iCloud Use for Confidential Data [User] (S)
|
|
|
---------+ SYS.2.4.A9 Using Additional Protection Programs in macOS (S)
|
|
|
---------+ SYS.2.4.A10 Activating the Personal Firewall in macOS (S)
|
|
|
---------+ SYS.2.4.A11 Disposing of Macs (S)
|
|
|
---------+ SYS.2.4.A12 Firmware Password and Boot Protection on Macs [User] (H)
|
|
|
------+ SYS.3.1 Laptops
|
|
|
---------+ SYS.3.1.G1. Degradation due to changing operational environments
|
|
|
---------+ SYS.3.1.G2. Theft and loss of laptops
|
|
|
---------+ SYS.3.1.G3. Unregulated Changes of Laptop Users
|
|
|
---------+ SYS.3.1.A1 Rules for Mobile Laptop Use (B)
|
|
|
---------+ SYS.3.1.A3 Use of Personal Firewalls (B)
|
|
|
---------+ SYS.3.1.A9 Secure Remote Access with Laptops (B)
|
|
|
---------+ SYS.3.1.A6 Security Guidelines for Laptops (S)
|
|
|
---------+ SYS.3.1.A7 Orderly Issue and Return of Laptops [User] (S)
|
|
|
---------+ SYS.3.1.A8 Secure Connection of Laptops to Data Networks [User] (S)
|
|
|
---------+ SYS.3.1.A10 Synchronisation of Stored Data on Laptops [User] (S)
|
|
|
---------+ SYS.3.1.A11 Securing the Power Supply for Laptops [User] (S)
|
|
|
---------+ SYS.3.1.A12 Reporting the Loss of Laptops [User] (S)
|
|
|
---------+ SYS.3.1.A13 Encryption of Laptops (S)
|
|
|
---------+ SYS.3.1.A14 Suitable Storage of Laptops [User] (S)
|
|
|
---------+ SYS.3.1.A15 Appropriate Selection of Laptops [Procurement Department] (S)
|
|
|
---------+ SYS.3.1.A16 Central Administration and Administration of Laptops (H)
|
|
|
---------+ SYS.3.1.A17 Pooled Storage of Laptops (H)
|
|
|
---------+ SYS.3.1.A18 Use of Anti-Theft Devices (H)
|
|
|
------+ SYS.3.2.1 General Smartphones and Tablets
|
|
|
---------+ SYS.3.2.1.G1. Lack of Operating System Updates
|
|
|
---------+ SYS.3.2.1.G2. Software Vulnerabilities in Pre-Installed Apps
|
|
|
---------+ SYS.3.2.1.G3. Manipulation of Smartphones and Tablets
|
|
|
---------+ SYS.3.2.1.G4. Malware for Smartphones and Tablets
|
|
|
---------+ SYS.3.2.1.G5. Web-based Attacks on Mobile Browsers
|
|
|
---------+ SYS.3.2.1.G6. Misuse of Health, Fitness, or Location Data
|
|
|
---------+ SYS.3.2.1.G7. Misuse of Sensitive Data on the Lock Screen
|
|
|
---------+ SYS.3.2.1.G8. Dangers from Private Use of Work-Related Smartphones and Tablets
|
|
|
---------+ SYS.3.2.1.G9. Threats Related to Bring-Your-Own-Device (BYOD) Scenarios
|
|
|
---------+ SYS.3.2.1.G10. Extended Rights Through Vulnerabilities
|
|
|
---------+ SYS.3.2.1.A1 Definition of a Policy for Using Smartphones and Tablets (B)
|
|
|
---------+ SYS.3.2.1.A2 Drawing Up a Strategy for Cloud Usage (B)
|
|
|
---------+ SYS.3.2.1.A3 Secure Basic Configuration for Mobile Devices (B)
|
|
|
---------+ SYS.3.2.1.A4 Use of an Access Control Mechanism [User] (B)
|
|
|
---------+ SYS.3.2.1.A5 Operating System and App Updates (B)
|
|
|
---------+ SYS.3.2.1.A6 Privacy Settings and Authorisations (B)
|
|
|
---------+ SYS.3.2.1.A7 Code of Conduct in the Event of Security Incidents [User] (B)
|
|
|
---------+ SYS.3.2.1.A8 Installation of Apps (B)
|
|
|
---------+ SYS.3.2.1.A9 Restrictive Use of Functional Extensions (S)
|
|
|
---------+ SYS.3.2.1.A10 Policy for Employees Regarding the Use of Mobile Devices [User] (S)
|
|
|
---------+ SYS.3.2.1.A11 Storage Encryption (S)
|
|
|
---------+ SYS.3.2.1.A12 Use of Non-Personalised Device Names (S)
|
|
|
---------+ SYS.3.2.1.A13 Rules Regarding Screen Sharing and Casting (S)
|
|
|
---------+ SYS.3.2.1.A16 Disabling Unused Communication Interfaces [User] (S)
|
|
|
---------+ SYS.3.2.1.A18 Use of Biometric Authentication (S)
|
|
|
---------+ SYS.3.2.1.A19 Use of a Voice Assistant (S)
|
|
|
---------+ SYS.3.2.1.A22 Integrating Mobile Devices into Internal Infrastructure via VPN (S)
|
|
|
---------+ SYS.3.2.1.A28 Using the Filter Option for Websites (S)
|
|
|
---------+ SYS.3.2.1.A31 Regulation of Mobile Payments (S)
|
|
|
---------+ SYS.3.2.1.A32 MDM Usage (S)
|
|
|
---------+ SYS.3.2.1.A33 Selection and Installation of Security Apps (S)
|
|
|
---------+ SYS.3.2.1.A34 Configuration of the DNS Server Used (S)
|
|
|
---------+ SYS.3.2.1.A25 Use of Separate Work Environments (H)
|
|
|
---------+ SYS.3.2.1.A26 Use of PIM Containers (H)
|
|
|
---------+ SYS.3.2.1.A27 Use of Specially Secured End Devices (H)
|
|
|
---------+ SYS.3.2.1.A29 Use of an Organisation-Related APN (H)
|
|
|
---------+ SYS.3.2.1.A30 Restricted App Installation Using a Whitelist (H)
|
|
|
---------+ SYS.3.2.1.A35 Using a Firewall (H)
|
|
|
------+ SYS.3.2.2 Mobile Device Management (MDM)
|
|
|
---------+ SYS.3.2.2.G1. Insufficient Synchronisation with the MDM System
|
|
|
---------+ SYS.3.2.2.G2. Improper MDM Administration
|
|
|
---------+ SYS.3.2.2.G3. Inappropriate Rights Management in MDM Systems
|
|
|
---------+ SYS.3.2.2.G4. Unauthorised Creation of Movement Profiles Through the MDM System
|
|
|
---------+ SYS.3.2.2.A1 Determining a Strategy for Mobile Device Management (B)
|
|
|
---------+ SYS.3.2.2.A2 Defining Admissible Mobile Devices (B)
|
|
|
---------+ SYS.3.2.2.A3 Selecting an MDM Product (B)
|
|
|
---------+ SYS.3.2.2.A4 Distribution of the Basic Configuration to Mobile Devices (B)
|
|
|
---------+ SYS.3.2.2.A5 Installing the MDM Client (B)
|
|
|
---------+ SYS.3.2.2.A20 Regular Review of the MDM System (B)
|
|
|
---------+ SYS.3.2.2.A6 Logging the Device Status (S)
|
|
|
---------+ SYS.3.2.2.A7 Installation of Apps (S)
|
|
|
---------+ SYS.3.2.2.A12 Protection of the MDM Operating Environment (S)
|
|
|
---------+ SYS.3.2.2.A21 Administration of Certificates (S)
|
|
|
---------+ SYS.3.2.2.A22 Remote Deletion and Decommissioning of End Devices (S)
|
|
|
---------+ SYS.3.2.2.A14 Use of External Reputation Services for Apps (H)
|
|
|
---------+ SYS.3.2.2.A17 Monitoring the Use of Mobile Devices (H)
|
|
|
---------+ SYS.3.2.2.A19 Using Geofencing (H)
|
|
|
---------+ SYS.3.2.2.A23 Enforcing Compliance Requirements (H)
|
|
|
------+ SYS.3.2.3 iOS (for Enterprise)
|
|
|
---------+ SYS.3.2.3.G1. Concentration of Risk When One User Account (Apple ID) is Used for all Apple services
|
|
|
---------+ SYS.3.2.3.G2. Fixed Integration of Pre-Installed Apps and Their Functions
|
|
|
---------+ SYS.3.2.3.G3. Improper Access to Outsourced Data
|
|
|
---------+ SYS.3.2.3.A1 Strategy for Using iOS Devices (B)
|
|
|
---------+ SYS.3.2.3.A2 Planning the Use of Cloud Services (B)
|
|
|
---------+ SYS.3.2.3.A7 Preventing Unauthorised Deletion of Configuration Profiles (B)
|
|
|
---------+ SYS.3.2.3.A12 Using Apple IDs (S)
|
|
|
---------+ SYS.3.2.3.A13 Using the “iOS Restrictions” Configuration Option (S)
|
|
|
---------+ SYS.3.2.3.A14 Using the iCloud Infrastructure (S)
|
|
|
---------+ SYS.3.2.3.A15 Using Continuity Functions (S)
|
|
|
---------+ SYS.3.2.3.A17 Using the Device Code History (S)
|
|
|
---------+ SYS.3.2.3.A18 Using the Configuration Option for the Safari Browser (S)
|
|
|
---------+ SYS.3.2.3.A21 Installation of Apps and Integration of the Apple App Store (S)
|
|
|
---------+ SYS.3.2.3.A23 Using Automatic Deletion of Configuration Profiles (H)
|
|
|
---------+ SYS.3.2.3.A25 Using the Configuration Option for AirPrint (H)
|
|
|
---------+ SYS.3.2.3.A26 No Connections to Host Systems (H)
|
|
|
------+ SYS.3.2.4 Android
|
|
|
---------+ SYS.3.2.4.G1. Disabling Security Features
|
|
|
---------+ SYS.3.2.4.G2. Malware for the Android Operating System
|
|
|
---------+ SYS.3.2.4.G3. Lack of Updates for the Android Operating System
|
|
|
---------+ SYS.3.2.4.G4. Risks Posed by User Accounts (Google Accounts) for Google Services
|
|
|
---------+ SYS.3.2.4.G5. Pre-Installed apps and Integrated Functions on Android-Based Devices
|
|
|
---------+ SYS.3.2.4.A2 Disabling Developer Options (S)
|
|
|
---------+ SYS.3.2.4.A3 Using Multi-User and Guest Mode (S)
|
|
|
---------+ SYS.3.2.4.A5 Advanced Security Settings (S)
|
|
|
------+ SYS.3.3 Mobile Telephones
|
|
|
---------+ SYS.3.3.G1. Inadequate Planning for the Purchase of Mobile Phones
|
|
|
---------+ SYS.3.3.G2. Loss of a Mobile Phone
|
|
|
---------+ SYS.3.3.G3. Carelessness in Handling Mobile Telephony Information
|
|
|
---------+ SYS.3.3.G4. Unauthorised Private Use of a Mobile Business Phone
|
|
|
---------+ SYS.3.3.G5. Mobile Telephone Failure
|
|
|
---------+ SYS.3.3.G6. Analysis of Call Data Relating to the Use of Mobile Phones
|
|
|
---------+ SYS.3.3.G7. Eavesdropping on Indoor Conversations over Mobile Phones
|
|
|
---------+ SYS.3.3.G8. Use of Obsolete Mobile Phones
|
|
|
---------+ SYS.3.3.A1 Security Guidelines and Rules for the Use of Mobile Phones (B)
|
|
|
---------+ SYS.3.3.A2 Blocking Lost Mobile Telephones [User] (B)
|
|
|
---------+ SYS.3.3.A3 Raising Employee Awareness and Providing Training on the Use of Mobile Telephones (B)
|
|
|
---------+ SYS.3.3.A4 Decommissioning and Properly Disposing of Mobile Telephones and the Memory Cards Used in Them (B)
|
|
|
---------+ SYS.3.3.A5 Use of the Security Mechanisms of Mobile Telephones [User] (S)
|
|
|
---------+ SYS.3.3.A6 Mobile Telephone Updates [User] (S)
|
|
|
---------+ SYS.3.3.A7 Acquisition of Mobile Telephones (S)
|
|
|
---------+ SYS.3.3.A8 Use of the Wireless Interfaces of Mobile Telephones [User] (S)
|
|
|
---------+ SYS.3.3.A10 Secure Data Transmission via Mobile Phones [User] (S)
|
|
|
---------+ SYS.3.3.A11 Precautions for Mobile Telephones [User] (S)
|
|
|
---------+ SYS.3.3.A12 Setting Up a Mobile Telephone Pool (S)
|
|
|
---------+ SYS.3.3.A9 Securing the Power Supply for Mobile Telephones [User] (H)
|
|
|
---------+ SYS.3.3.A13 Protection Against Mobile Telephone Data Being Used to Create Movement Profiles [User] (H)
|
|
|
---------+ SYS.3.3.A14 Protection Against Call Number Identification During Use of Mobile Telephones [User] (H)
|
|
|
---------+ SYS.3.3.A15 Protection Against Eavesdropping on Indoor Conversations Using Mobile Telephones (H)
|
|
|
------+ SYS.4.1 Printers, Copiers, and All-in-One Devices
|
|
|
---------+ SYS.4.1.G1. Unauthorised Access to Printed Documents
|
|
|
---------+ SYS.4.1.G2. Visibility of Metadata
|
|
|
---------+ SYS.4.1.G3. Insufficient Protection of Stored Information
|
|
|
---------+ SYS.4.1.G4. Unencrypted Communication
|
|
|
---------+ SYS.4.1.G5. Unauthorised Sending of Information
|
|
|
---------+ SYS.4.1.G6. Uncontrolled Data Exchange via Memory Interfaces on Printers, Copiers, and All-in-One Devices
|
|
|
---------+ SYS.4.1.G7. Inadequately Secured Network Access of Printers, Copiers, and All-in-One Devices
|
|
|
---------+ SYS.4.1.G8. Poor Access Protection for Device Administration
|
|
|
---------+ SYS.4.1.A1 Planning the Use of Printers, Copiers, and All-in-One Devices (B)
|
|
|
---------+ SYS.4.1.A2 Suitable Siting and Access to Printers, Copiers, and All-in-One Devices (B)
|
|
|
---------+ SYS.4.1.A22 Proper Disposal of Printed Documents (B)
|
|
|
---------+ SYS.4.1.A4 Drawing Up a Security Policy for the Use of Printers, Copiers, and All-in-One Devices (S)
|
|
|
---------+ SYS.4.1.A5 Drawing Up User Guidelines for Handling Printers, Copiers, and All-in-One Devices [Chief Information Security Officer (CISO)] (S)
|
|
|
---------+ SYS.4.1.A7 Restriction of Remote Administrative Access to Printers, Copiers, and All-in-One Devices (S)
|
|
|
---------+ SYS.4.1.A11 Restricting the Connection of Printers, Copiers, and All-in-One Devices (S)
|
|
|
---------+ SYS.4.1.A15 Encryption of Information for Printers, Copiers, and All-in-One Devices (S)
|
|
|
---------+ SYS.4.1.A17 Protection of Payloads and Metadata (S)
|
|
|
---------+ SYS.4.1.A18 Configuration of Printers, Copiers, and All-in-One Devices (S)
|
|
|
---------+ SYS.4.1.A14 Authentication and Authorisation for Printers, Copiers, and All-in-One Devices (H)
|
|
|
---------+ SYS.4.1.A16 Reducing Downtimes for Printers, Copiers, and All-in-One Devices (H)
|
|
|
---------+ SYS.4.1.A20 Enhanced Information Protection for Printers, Copiers, and All-in-One Devices (C)
|
|
|
---------+ SYS.4.1.A21 Extended Protection of Printers, Copiers, and All-in-One Devices (H)
|
|
|
------+ SYS.4.3 Embedded Systems
|
|
|
---------+ SYS.4.3.G1. Inadequate Security Requirements for Developing Embedded Systems
|
|
|
---------+ SYS.4.3.G2. Unprotected Input/Output Interfaces in Embedded Systems
|
|
|
---------+ SYS.4.3.G3. Inadequate Physical Protection of Embedded Systems
|
|
|
---------+ SYS.4.3.G4. Hardware Failure and Hardware Errors with Embedded Systems
|
|
|
---------+ SYS.4.3.G5. Installation (Flashing) of Manipulated Software Updates on Embedded Systems
|
|
|
---------+ SYS.4.3.G6. Side-Channel Attacks on Embedded Crypto Systems
|
|
|
---------+ SYS.4.3.G7. Penetration and Manipulation via the Communication Interface of Embedded Systems
|
|
|
---------+ SYS.4.3.G8. Use of Forged Components
|
|
|
---------+ SYS.4.3.A1 Rules for Handling Embedded Systems (B)
|
|
|
---------+ SYS.4.3.A2 Disabling Unused Interfaces and Services of Embedded Systems [Developer] (B)
|
|
|
---------+ SYS.4.3.A3 Logging Security-Relevant Events in Embedded Systems (B)
|
|
|
---------+ SYS.4.3.A4 Creating Procurement Criteria for Embedded Systems [Procurement Department] (S)
|
|
|
---------+ SYS.4.3.A5 Protecting Embedded Systems Against Damaging Environmental Influences [Developer, Planner] (S)
|
|
|
---------+ SYS.4.3.A6 Preventing Debugging Options for Embedded Systems [Developer] (S)
|
|
|
---------+ SYS.4.3.A7 Hardware Realisation of the Features of Embedded Systems [Developer, Planner, Procurement Department] (S)
|
|
|
---------+ SYS.4.3.A8 Using a Secure Operating System for Embedded Systems [Developer, Planner, Procurement Department] (S)
|
|
|
---------+ SYS.4.3.A9 Use of Cryptographic Processors or Coprocessors in Embedded Systems [Developer, Planner, Procurement Department] (S)
|
|
|
---------+ SYS.4.3.A10 Recovery of Embedded Systems (S)
|
|
|
---------+ SYS.4.3.A11 Secure Disposal of Embedded Systems (S)
|
|
|
---------+ SYS.4.3.A12 Selection of a Trustworthy Supplier and Logistics Chain and a Qualified Manufacturer for Embedded Systems [Procurement Department] (H)
|
|
|
---------+ SYS.4.3.A13 Use of a Certified Operating System [Developer, Planner, Procurement Department] (H)
|
|
|
---------+ SYS.4.3.A14 Secured and Authenticated Boot Process for Embedded Systems [Developer, Planner, Procurement Department] (H)
|
|
|
---------+ SYS.4.3.A15 Storage Protection in Embedded Systems [Developer, Planner, Procurement Department] (H)
|
|
|
---------+ SYS.4.3.A16 Tamper Protection for Embedded Systems [Planner] (H)
|
|
|
---------+ SYS.4.3.A17 Automatic Monitoring of Assembly Functions [Planner, Procurement Department] (H)
|
|
|
---------+ SYS.4.3.A18 Resistance of Embedded Systems to Side-Channel Attacks [Developer, Procurement Department] (H)
|
|
|
------+ SYS.4.4 General IoT Devices
|
|
|
---------+ SYS.4.4.G1. Espionage using IoT Devices
|
|
|
---------+ SYS.4.4.G2. Use of UPnP
|
|
|
---------+ SYS.4.4.G3. Distributed Denial of Service (DDoS)
|
|
|
---------+ SYS.4.4.G4. Espionage Attacks Through Backdoors in IoT Devices
|
|
|
---------+ SYS.4.4.A1 Criteria for Using IoT Devices (B)
|
|
|
---------+ SYS.4.4.A2 Authentication (B)
|
|
|
---------+ SYS.4.4.A5 Restriction of Network Access (B)
|
|
|
---------+ SYS.4.4.A6 Integration of IoT Devices into Organisation Security Policies (S)
|
|
|
---------+ SYS.4.4.A7 Planning the Use of IoT Devices (S)
|
|
|
---------+ SYS.4.4.A8 Procurement Criteria for IoT Devices [Procurement Department] (S)
|
|
|
---------+ SYS.4.4.A9 Controlling the Use of IoT Devices (S)
|
|
|
---------+ SYS.4.4.A10 Secure Installation and Configuration of IoT Devices (S)
|
|
|
---------+ SYS.4.4.A11 Using Encrypted Data Transmission (S)
|
|
|
---------+ SYS.4.4.A13 Deactivation and Uninstallation of Unnecessary Components (S)
|
|
|
---------+ SYS.4.4.A15 Restrictive Granting of Access Rights (S)
|
|
|
---------+ SYS.4.4.A16 Elimination of Malware on IoT Devices (S)
|
|
|
---------+ SYS.4.4.A17 Monitoring Network Traffic on IoT Devices (S)
|
|
|
---------+ SYS.4.4.A18 Logging Security-Relevant Events on IoT Devices (S)
|
|
|
---------+ SYS.4.4.A19 Protection of Administration Interfaces (S)
|
|
|
---------+ SYS.4.4.A20 Controlled Decommissioning of IoT Devices (S)
|
|
|
---------+ SYS.4.4.A21 Operational Environment and Power Supply [Building Services] (H)
|
|
|
---------+ SYS.4.4.A22 System Monitoring (H)
|
|
|
---------+ SYS.4.4.A23 Auditing of IoT Devices (H)
|
|
|
---------+ SYS.4.4.A24 Secure Configuration and Usage of an Embedded Web Server (H)
|
|
|
------+ SYS.4.5 Removable Media
|
|
|
---------+ SYS.4.5.G1. Carelessness in Handling Information
|
|
|
---------+ SYS.4.5.G2. Insufficient Knowledge of Rules and Procedures
|
|
|
---------+ SYS.4.5.G3. Theft or Loss of Removable Media
|
|
|
---------+ SYS.4.5.G4. Defective Storage Media
|
|
|
---------+ SYS.4.5.G5. Degradation due to Changing Operational Environments
|
|
|
---------+ SYS.4.5.G6. Spreading of Malware
|
|
|
---------+ SYS.4.5.A1 Raising Staff Awareness of Secure Handling of Removable Media (B)
|
|
|
---------+ SYS.4.5.A2 Reporting Losses / Tampering [User] (B)
|
|
|
---------+ SYS.4.5.A10 Encryption of Storage Media (B)
|
|
|
---------+ SYS.4.5.A12 Protection Against Malware [User] (B)
|
|
|
---------+ SYS.4.5.A4 Drawing Up a Policy for the Secure Handling of Removable Media (S)
|
|
|
---------+ SYS.4.5.A5 Rules on the Transport of Removable Media (S)
|
|
|
---------+ SYS.4.5.A6 Storage Media Management [Process Owner] (S)
|
|
|
---------+ SYS.4.5.A7 Secure Deletion of Storage Media Before and After Use [Process Owner] (S)
|
|
|
---------+ SYS.4.5.A13 Appropriate Labelling of Storage Media for Shipping [User] (S)
|
|
|
---------+ SYS.4.5.A11 Protecting Integrity Using Checksums or Digital Signatures (H)
|
|
|
---------+ SYS.4.5.A14 Secure Shipping and Packaging (H)
|
|
|
---------+ SYS.4.5.A15 Certified Products (H)
|
|
|
---------+ SYS.4.5.A16 Use of Dedicated Systems for Data Scanning (H)
|
|
|
---+ Industrial IT
|
|
|
------+ IND.1 Process Control and Automation Technology
|
|
|
---------+ IND.1.G1. Impairment Due to Harmful Environmental Influences
|
|
|
---------+ IND.1.G2. Inappropriate Integration of OT into the Security Organisation
|
|
|
---------+ IND.1.G3. Inappropriate Integration of OT into Operating Procedures
|
|
|
---------+ IND.1.G4. Insufficient Access Protection
|
|
|
---------+ IND.1.G5. Insecure Process for Project Planning or Application Development
|
|
|
---------+ IND.1.G6. Insecure Administration Concept and Remote Administration
|
|
|
---------+ IND.1.G7. Inadequate Monitoring and Detection Procedures
|
|
|
---------+ IND.1.G8. Inadequate Test Concept
|
|
|
---------+ IND.1.G9. Lack of Lifecycle Concepts
|
|
|
---------+ IND.1.G10. Insufficient Security Requirements in Procurement
|
|
|
---------+ IND.1.G11. Use of Insecure Protocols
|
|
|
---------+ IND.1.G12. Insecure Configuration of ICS Components
|
|
|
---------+ IND.1.G13. Dependencies between OT and IT Networks
|
|
|
---------+ IND.1.A1 Integration into the Security Organisation (B)
|
|
|
---------+ IND.1.A3 Protection Against Malware (B)
|
|
|
---------+ IND.1.A18 Logging [OT Operations)] (B)
|
|
|
---------+ IND.1.A19 Creating Backups [Employee, OT Operations] (B)
|
|
|
---------+ IND.1.A4 Documentation of OT Infrastructure (S)
|
|
|
---------+ IND.1.A5 Development of a Suitable Zone Concept [Planner] (S)
|
|
|
---------+ IND.1.A6 Change Management in OT Operations (S)
|
|
|
---------+ IND.1.A7 Establishing Comprehensive Authorisation Management Across OT and Office IT (S)
|
|
|
---------+ IND.1.A8 Secure Administration [IT Operation Department] (S)
|
|
|
---------+ IND.1.A9 Restrictive Use of Removable Media and Mobile Devices in ICS Environments (S)
|
|
|
---------+ IND.1.A10 Monitoring, Logging, and Detection [OT Operations] (S)
|
|
|
---------+ IND.1.A11 Secure Procurement and System Development (S)
|
|
|
---------+ IND.1.A12 Establishing Vulnerability Management (S)
|
|
|
---------+ IND.1.A20 System Documentation [Employee, OT Operations] (S)
|
|
|
---------+ IND.1.A21 Documentation of Communication Relationships [OT Operations (Operational Technology, OT)] (S)
|
|
|
---------+ IND.1.A22 Central System Logging and System Monitoring [OT Operations] (S)
|
|
|
---------+ IND.1.A23 Disposal of ICS Components [OT Operations] (S)
|
|
|
---------+ IND.1.A13 Contingency Planning for OT (H)
|
|
|
---------+ IND.1.A14 Strong Authentication for OT Components (H)
|
|
|
---------+ IND.1.A15 Monitoring of Wide-Ranging Authorisations (H)
|
|
|
---------+ IND.1.A16 Stronger Compartmentalisation of Zones (H)
|
|
|
---------+ IND.1.A17 Regular Security Vetting (H)
|
|
|
---------+ IND.1.A24 Communication in the Event of Incidents [OT Operations] (S)
|
|
|
------+ IND.2.1 General ICS Components
|
|
|
---------+ IND.2.1.G1. Insecure System Configuration
|
|
|
---------+ IND.2.1.G2. Insufficient User and Authorisation Management
|
|
|
---------+ IND.2.1.G3. Insufficient Logging
|
|
|
---------+ IND.2.1.G4. Manipulation and Sabotage of an ICS Component
|
|
|
---------+ IND.2.1.G5. Use of Insecure Protocols
|
|
|
---------+ IND.2.1.G6. Denial-of-Service (DoS) Attacks
|
|
|
---------+ IND.2.1.G7. Malware
|
|
|
---------+ IND.2.1.G8. Interception of Information/Espionage
|
|
|
---------+ IND.2.1.G9. Manipulated Firmware
|
|
|
---------+ IND.2.1.A1 Restriction of Access to Configuration and Maintenance Interfaces [OT Operations] (B)
|
|
|
---------+ IND.2.1.A2 Using Secure Transmission Protocols for Configuration and Maintenance [Maintenance Personnel, OT Operations] (B)
|
|
|
---------+ IND.2.1.A4 Disabling or Uninstalling Unused Services, Functions, and Interfaces [Maintenance Personnel, OT Operations] (B)
|
|
|
---------+ IND.2.1.A6 Network Segmentation [OT Operations, Planner] (B)
|
|
|
---------+ IND.2.1.A7 Creating Backups [OT Operations] (S)
|
|
|
---------+ IND.2.1.A8 Protection Against Malware [OT Operations] (S)
|
|
|
---------+ IND.2.1.A11 Maintenance of ICS Components [Employee, OT Operations, Maintenance Personnel] (S)
|
|
|
---------+ IND.2.1.A13 Appropriate Commissioning of ICS Components [OT Operations] (S)
|
|
|
---------+ IND.2.1.A16 Protecting External Interfaces [OT Operations] (S)
|
|
|
---------+ IND.2.1.A17 Use of Secure Protocols for the Transmission of Measurement and Control Data [OT Operations] (S)
|
|
|
---------+ IND.2.1.A18 Communication in the Event of Incidents [OT Operations, Employee] (S)
|
|
|
---------+ IND.2.1.A19 Security Tests [OT Operations] (H)
|
|
|
---------+ IND.2.1.A20 Trustworthy Code [OT Operations] (H)
|
|
|
------+ IND.2.2 Programmable Logic Controller (PLC)
|
|
|
---------+ IND.2.2.G1. Incomplete Documentation
|
|
|
---------+ IND.2.2.A1 Extended System Documentation for Programmable Logic Controllers [OT Operations] (S)
|
|
|
---------+ IND.2.2.A3 Time Synchronisation [OT Operations] (S)
|
|
|
------+ IND.2.3 Sensors and Actuators
|
|
|
---------+ IND.2.3.G1. Insufficient Security Requirements in Procurement
|
|
|
---------+ IND.2.3.A1 Installation of Sensors [OT Operations, Maintenance Personnel] (B)
|
|
|
---------+ IND.2.3.A2 Calibration of Sensors [Maintenance Personnel] (S)
|
|
|
---------+ IND.2.3.A3 Wireless Communication (H)
|
|
|
------+ IND.2.4 Machine
|
|
|
---------+ IND.2.4.G1. Failure or Disruption due to Insufficient Maintenance
|
|
|
---------+ IND.2.4.G2. Targeted manipulations
|
|
|
---------+ IND.2.4.A1 Remote Maintenance by Mechanical and System Engineers [OT Operations] (B)
|
|
|
---------+ IND.2.4.A2 Operation After End of Warranty [OT Operations] (B)
|
|
|
------+ IND.2.7 Safety Instrumented Systems
|
|
|
---------+ IND.2.7.G1. Manipulation of the Logic System
|
|
|
---------+ IND.2.7.G2. Inadequate Monitoring and Detection Procedures
|
|
|
---------+ IND.2.7.A1 Recording and Documentation [Planner, Maintenance Personnel] (B)
|
|
|
---------+ IND.2.7.A2 Specified Use of Hardware and Software Components [Maintenance Personnel] (B)
|
|
|
---------+ IND.2.7.A3 Changing the Application Program on the Logic System [Maintenance Personnel] (B)
|
|
|
---------+ IND.2.7.A4 Making Information Security an Integral Part of Functional Safety Management [ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A5 SIS Business Continuity Management [ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A6 Secure Planning and Specification of SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A7 Separation and Independence of the SIS from the Environment [Planner, Maintenance Personnel] (S)
|
|
|
---------+ IND.2.7.A8 Secure Transfer of Engineering Data to SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A9 Protection of Data and Signal Connections [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A10 Displays and Alerts Pertaining to Simulated or Bridged Variables [Planner] (S)
|
|
|
---------+ IND.2.7.A11 Dealing with Integrated Systems [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
|
|
|
---------+ IND.2.7.A12 Ensuring the Integrity and Authenticity of Application Programs and Configuration Data [Planner] (H)
|
|
|
------+ IND.3.2 Remote Maintenance in Industry
|
|
|
---------+ IND.3.2.G1. Incomplete Documentation of Remote Maintenance Access in OT
|
|
|
---------+ IND.3.2.G2. Insufficient Availability Due to Dependencies on Office and Building IT
|
|
|
---------+ IND.3.2.G3. Inadequate Regulations for the Use of OT Remote Maintenance Access
|
|
|
---------+ IND.3.2.G4. Insufficient Human Control of OT Remote Maintenance Sessions
|
|
|
---------+ IND.3.2.G5. Direct Technical Access to ICS from Insecure Zones
|
|
|
---------+ IND.3.2.G6. Insecure Alternative OT Remote Maintenance Access in Case of Disruptions
|
|
|
---------+ IND.3.2.G7. Insecure Technical Design of OT Remote Maintenance Access
|
|
|
---------+ IND.3.2.G8. Outdated Technical Design of OT Remote Maintenance Access
|
|
|
---------+ IND.3.2.A1 Planning the Use of Remote Maintenance in OT (B) [Planner]
|
|
|
---------+ IND.3.2.A2 Consistent Documentation of Remote Maintenance by OT and Office and Building IT (B) [IT Operation Department, Maintenance Personnel]
|
|
|
---------+ IND.3.2.A3 Regular Checks and Exceptions for Existing OT Remote Maintenance Access (B) [IT Operation Department]
|
|
|
---------+ IND.3.2.A4 Binding Regulation of OT Remote Maintenance by Third Parties (B)
|
|
|
---------+ IND.3.2.A5 Internal Coordination for OT Remote Maintenance with Office and Building IT (B) [Planner]
|
|
|
---------+ IND.3.2.A6 Securing All Remote Maintenance Access to OT (B) [IT Operation Department]
|
|
|
---------+ IND.3.2.A7 Technical Decoupling of Access (S) [Planner]
|
|
|
---------+ IND.3.2.A8 Explicit Approval of Every OT Remote Maintenance Session (S) [Employee]
|
|
|
---------+ IND.3.2.A9 Secure Exchange of Files Involved in OT Remote Maintenance (S) [Planner, IT Operation Department]
|
|
|
---------+ IND.3.2.A10 Observation and Control of OT Remote Maintenance Sessions (S) [Employee]
|
|
|
---------+ IND.3.2.A11 Central Management of All User Accounts for OT Remote Maintenance (S) [IT Operation Department]
|
|
|
---------+ IND.3.2.A12 Dedicated OT Remote Maintenance Solution (H) [Planner]
|
|
|
---------+ IND.3.2.A13 Logging of Contents of Remote Maintenance Access in OT (H) [Planner, Data Protection Officer]
|
|
|
---------+ IND.3.2.A14 Technical Control of Remote Maintenance Sessions (H) [Planner, Data Protection Officer]
|
|
|
---+ Networks and Communication
|
|
|
------+ NET.1.1 Network Architecture and Design
|
|
|
---------+ NET.1.1.G1. Failure or Insufficient Performance of Communication Links
|
|
|
---------+ NET.1.1.G2. Inadequately Secured Network Access
|
|
|
---------+ NET.1.1.G3. Inadequate Network Structuring
|
|
|
---------+ NET.1.1.A1 Security Policy for the Network [IT Operation Department] (B)
|
|
|
---------+ NET.1.1.A2 Documentation of the Network [IT Operation Department] (B)
|
|
|
---------+ NET.1.1.A3 Specification of Network Requirements (B)
|
|
|
---------+ NET.1.1.A4 Network Separation into Zones (B)
|
|
|
---------+ NET.1.1.A5 Client-Server Segmentation (B)
|
|
|
---------+ NET.1.1.A6 End Device Segmentation in the Internal Network (B)
|
|
|
---------+ NET.1.1.A7 Protection of Sensitive Information (B)
|
|
|
---------+ NET.1.1.A8 Basic Protection of Internet Access (B)
|
|
|
---------+ NET.1.1.A9 Basic Protection of Communication with Untrusted Networks (B)
|
|
|
---------+ NET.1.1.A10 DMZ Segmentation for Access from the Internet (B)
|
|
|
---------+ NET.1.1.A11 Protection of Communications Entering the Internal Network from the Internet (B)
|
|
|
---------+ NET.1.1.A12 Protection of Outgoing Internal Communication to the Internet (B)
|
|
|
---------+ NET.1.1.A13 Network Planning (B)
|
|
|
---------+ NET.1.1.A14 Implementation of Network Planning (B)
|
|
|
---------+ NET.1.1.A15 Regular Gap Analysis (B)
|
|
|
---------+ NET.1.1.A16 Specification of Network Architecture (S)
|
|
|
---------+ NET.1.1.A17 Specification of Network Design (S)
|
|
|
---------+ NET.1.1.A18 P-A-P Structure for the Internet Connection (S)
|
|
|
---------+ NET.1.1.A19 Separation of Infrastructure Services (S)
|
|
|
---------+ NET.1.1.A20 Allocation of Dedicated Sub-Networks for IPv4/IPv6 End Device Groups (S)
|
|
|
---------+ NET.1.1.A21 Separation of the Management Area (S)
|
|
|
---------+ NET.1.1.A22 Specification of the Segmentation Concept (S)
|
|
|
---------+ NET.1.1.A23 Separation of Network Segments (S)
|
|
|
---------+ NET.1.1.A24 Secure Logical Separation using VLAN (S)
|
|
|
---------+ NET.1.1.A25 Detailed and Implementation Planning of Network Architecture and Design (S)
|
|
|
---------+ NET.1.1.A26 Specification of Operating Processes for the Network (S)
|
|
|
---------+ NET.1.1.A27 Integration of Network Architecture into Contingency Planning [IT Operation Department] (S)
|
|
|
---------+ NET.1.1.A28 High-Availability Network and Security Components (H)
|
|
|
---------+ NET.1.1.A29 Implementing Network Connections for High Availability (H)
|
|
|
---------+ NET.1.1.A30 Protection Against Distributed Denial of Service (H)
|
|
|
---------+ NET.1.1.A31 Physical Separation of Network Segments (H)
|
|
|
---------+ NET.1.1.A32 Physical Separation of Management Network Segments (H)
|
|
|
---------+ NET.1.1.A33 Micro-Segmentation of the Network (H)
|
|
|
---------+ NET.1.1.A34 Use of Cryptographic Methods at the Network Level (H)
|
|
|
---------+ NET.1.1.A35 Use of Network-Based DLP (H)
|
|
|
---------+ NET.1.1.A36 Separation by Means of VLAN for Very High Protection Requirements (H)
|
|
|
------+ NET.1.2 Network Management
|
|
|
---------+ NET.1.2.G1. Unauthorised Access to Central Network Management Components
|
|
|
---------+ NET.1.2.G2. Unauthorised Access to Individual Network Components
|
|
|
---------+ NET.1.2.G3. Unauthorised Interference in Network Management Communication
|
|
|
---------+ NET.1.2.G4. Insufficient Time Synchronisation of Network Management Components
|
|
|
---------+ NET.1.2.A1 Network Management Planning (B)
|
|
|
---------+ NET.1.2.A2 Specification of Network Management Requirements (B)
|
|
|
---------+ NET.1.2.A6 Regular Backups (B)
|
|
|
---------+ NET.1.2.A7 Basic Logging of Events (B)
|
|
|
---------+ NET.1.2.A8 Time Synchronisation (B)
|
|
|
---------+ NET.1.2.A9 Protection of Network Management Communication and Access to Network Management Tools (B)
|
|
|
---------+ NET.1.2.A10 Limitation of SNMP Communication (B)
|
|
|
---------+ NET.1.2.A11 Definition of a Security Policy for Network Management (S)
|
|
|
---------+ NET.1.2.A12 Current Inventory and Documentation of Network Management (S)
|
|
|
---------+ NET.1.2.A13 Drawing Up a Network Management Concept (S)
|
|
|
---------+ NET.1.2.A14 Detailed and Implementation Planning (S)
|
|
|
---------+ NET.1.2.A15 Concept for Secure Operation of Network Management Infrastructure (S)
|
|
|
---------+ NET.1.2.A16 Setup and Configuration of Network Management Solutions (S)
|
|
|
---------+ NET.1.2.A17 Regular Gap Analysis within the Framework of Network Management (S)
|
|
|
---------+ NET.1.2.A18 Training Measures for Management Solutions [Supervisor] (S)
|
|
|
---------+ NET.1.2.A21 Decoupling of Network Management Communication (S)
|
|
|
---------+ NET.1.2.A22 Restriction of Management Functions (S)
|
|
|
---------+ NET.1.2.A24 Central Configuration Management for Network Components (S)
|
|
|
---------+ NET.1.2.A25 Status Monitoring for Network Components (S)
|
|
|
---------+ NET.1.2.A26 Alarming and Logging (S)
|
|
|
---------+ NET.1.2.A27 Integration of Network Management into Contingency Planning (S)
|
|
|
---------+ NET.1.2.A28 Location of Management Clients for In-Band Management (S)
|
|
|
---------+ NET.1.2.A29 Using VLANS in the Management Network (S)
|
|
|
---------+ NET.1.2.A30 Implementing Management Solutions for High Availability (H)
|
|
|
---------+ NET.1.2.A31 Basic Use of Secure Protocols (H)
|
|
|
---------+ NET.1.2.A32 Physical Separation of the Management Network [Planner] (H)
|
|
|
---------+ NET.1.2.A33 Physical Separation of Management Segments [Planner] (H)
|
|
|
---------+ NET.1.2.A35 Specifications for Securing Evidence (H)
|
|
|
---------+ NET.1.2.A36 Integration of Network Management Logging into an SIEM Solution (H)
|
|
|
---------+ NET.1.2.A37 Time Synchronisation Across Locations (H)
|
|
|
---------+ NET.1.2.A38 Specification of Forms of Emergency Operations for Network Management Infrastructure (H)
|
|
|
------+ NET.2.1 WLAN Operation
|
|
|
---------+ NET.2.1.G1. Failure or Disruption of a Radio Network
|
|
|
---------+ NET.2.1.G2. Inadequate Planning of WLAN Usage
|
|
|
---------+ NET.2.1.G3. Insufficient Rules on WLAN Usage
|
|
|
---------+ NET.2.1.G4. Inappropriate Selection of Authentication Methods
|
|
|
---------+ NET.2.1.G5. Incorrect Configuration of WLAN Infrastructure
|
|
|
---------+ NET.2.1.G6. Insufficient WLAN Security Mechanisms
|
|
|
---------+ NET.2.1.G7. Eavesdropping on WLAN Communication
|
|
|
---------+ NET.2.1.G8. Simulating a Valid Access Point (Rogue access Points)
|
|
|
---------+ NET.2.1.G9. Unprotected LAN Access at Access Points
|
|
|
---------+ NET.2.1.G10. Hardware Damage
|
|
|
---------+ NET.2.1.G11. Theft of an Access Point
|
|
|
---------+ NET.2.1.A1 Definition of a Strategy for WLAN Usage (B)
|
|
|
---------+ NET.2.1.A2 Selection of a Suitable WLAN Standard [Planner] (B)
|
|
|
---------+ NET.2.1.A3 Selection of Suitable Crypto Methods for WLAN [Planner] (B)
|
|
|
---------+ NET.2.1.A4 Suitable Location of Access Points [Building Services] (B)
|
|
|
---------+ NET.2.1.A5 Secure Basic Configuration of Access Points (B)
|
|
|
---------+ NET.2.1.A6 Secure Configuration of WLAN Infrastructure (B)
|
|
|
---------+ NET.2.1.A7 Setting Up a Distribution System [Planner] (B)
|
|
|
---------+ NET.2.1.A8 Codes of Conduct in the Event of WLAN Security Incidents (B)
|
|
|
---------+ NET.2.1.A9 Secure Connection of WLANs to a LAN [Planner] (S)
|
|
|
---------+ NET.2.1.A10 Drawing Up a Security Policy for WLAN Operation (S)
|
|
|
---------+ NET.2.1.A11 Selection of Suitable WLAN Components (S)
|
|
|
---------+ NET.2.1.A12 Use of a Suitable WLAN Management Solution (S)
|
|
|
---------+ NET.2.1.A13 Regular Security Checks of WLANs (S)
|
|
|
---------+ NET.2.1.A14 Regular Audits of WLAN Components (S)
|
|
|
---------+ NET.2.1.A15 Using a VPN to Secure WLANs (H)
|
|
|
---------+ NET.2.1.A16 Additional Protection When Connecting WLANs to a LAN (H)
|
|
|
---------+ NET.2.1.A17 Protecting Communication Between Access Points (H)
|
|
|
---------+ NET.2.1.A18 Use of Wireless Intrusion Detection / Wireless Intrusion Prevention Systems (H)
|
|
|
------+ NET.2.2 WLAN Usage
|
|
|
---------+ NET.2.2.G1. Insufficient Knowledge of Rules and Procedures
|
|
|
---------+ NET.2.2.G2. Non-Compliance with Security Safeguards
|
|
|
---------+ NET.2.2.G3. Eavesdropping on WLAN Communication
|
|
|
---------+ NET.2.2.G4. Analysis of Connection Data Related to Wireless Communication
|
|
|
---------+ NET.2.2.G5. Simulating a Valid Access Point (Rogue Access Points)
|
|
|
---------+ NET.2.2.A1 Creating a User Policy for WLAN [IT Operation Department] (B)
|
|
|
---------+ NET.2.2.A2 Awareness and Training of WLAN Users [Supervisor, IT Operation Department] (B)
|
|
|
---------+ NET.2.2.A3 Safeguarding WLAN Usage in Hotspots [IT Operation Department] (B)
|
|
|
---------+ NET.2.2.A4 Codes of Conduct in the Event of WLAN Security Incidents (S)
|
|
|
------+ NET.3.1 Routers and Switches
|
|
|
---------+ NET.3.1.G1. Distributed Denial of Service (DDoS)
|
|
|
---------+ NET.3.1.G2. Manipulation
|
|
|
---------+ NET.3.1.G3. Incorrect Configuration of a Router or Switch
|
|
|
---------+ NET.3.1.G4. Improper Planning and Design
|
|
|
---------+ NET.3.1.G5. Incompatible Active Network Components
|
|
|
---------+ NET.3.1.G6. MAC Flooding
|
|
|
---------+ NET.3.1.G7. Spanning Tree Attacks
|
|
|
---------+ NET.3.1.G8. GARP Attacks
|
|
|
---------+ NET.3.1.A1 Secure Basic Configuration of a Router or Switch (B)
|
|
|
---------+ NET.3.1.A4 Protection of Administration Interfaces (B)
|
|
|
---------+ NET.3.1.A5 Protection Against Fragmentation Attacks (B)
|
|
|
---------+ NET.3.1.A6 Emergency Access to Routers and Switches (B)
|
|
|
---------+ NET.3.1.A7 Logging on Routers and Switches (B)
|
|
|
---------+ NET.3.1.A8 Regular Backups (B)
|
|
|
---------+ NET.3.1.A9 Operational Documentation (B)
|
|
|
---------+ NET.3.1.A10 Creating a Security Policy(S)
|
|
|
---------+ NET.3.1.A11 Procurement of a Router or Switch (S)
|
|
|
---------+ NET.3.1.A12 Drawing Up a Configuration Checklist for Routers and Switches (S)
|
|
|
---------+ NET.3.1.A13 Administration Using a Separate Management Network (S)
|
|
|
---------+ NET.3.1.A14 Protection Against Misuse of ICMP Messages (S)
|
|
|
---------+ NET.3.1.A15 Bogon and Spoofing Filtering (S)
|
|
|
---------+ NET.3.1.A16 Protection Against “IPv6 Routing Header Type-0” attacks (S)
|
|
|
---------+ NET.3.1.A17 Protection Against DoS and DDoS Attacks (S)
|
|
|
---------+ NET.3.1.A18 Configuration of Access Control Lists (S)
|
|
|
---------+ NET.3.1.A19 Protection of Switch Ports (S)
|
|
|
---------+ NET.3.1.A20 Security Aspects of Routing Protocols (S)
|
|
|
---------+ NET.3.1.A21 Identity and Authorisation Management in Network Infrastructure (S)
|
|
|
---------+ NET.3.1.A22 Contingency Planning for Routers and Switches (S)
|
|
|
---------+ NET.3.1.A23 Audits and Penetration Tests (S)
|
|
|
---------+ NET.3.1.A24 Use of Network Access Controls (H)
|
|
|
---------+ NET.3.1.A25 Advanced Integrity Protection for Configuration Files (H)
|
|
|
---------+ NET.3.1.A26 High Availability (H)
|
|
|
---------+ NET.3.1.A27 Bandwidth Management for Critical Applications and Services (H)
|
|
|
---------+ NET.3.1.A28 Use of Certified Products (H)
|
|
|
------+ NET.3.2 Firewall
|
|
|
---------+ NET.3.2.G1. Distributed denial of service (DDoS)
|
|
|
---------+ NET.3.2.G2. Manipulation
|
|
|
---------+ NET.3.2.G3. Bypassing firewall rules
|
|
|
---------+ NET.3.2.G4. Incorrect configuration and errors in operating a firewall
|
|
|
---------+ NET.3.2.A1 Creating a Security Policy (B)
|
|
|
---------+ NET.3.2.A2 Definition of Firewall Rules (B)
|
|
|
---------+ NET.3.2.A3 Configuring Appropriate Filter Rules on the Packet Filter (B)
|
|
|
---------+ NET.3.2.A4 Secure Firewall Configuration (B)
|
|
|
---------+ NET.3.2.A6 Protection of Administration Interfaces (B)
|
|
|
---------+ NET.3.2.A7 Emergency Access to the Firewall (B)
|
|
|
---------+ NET.3.2.A8 Prevention of Dynamic Routing (B)
|
|
|
---------+ NET.3.2.A9 Logging (B)
|
|
|
---------+ NET.3.2.A10 Protection Against Fragmentation Attacks on the Packet Filter (B)
|
|
|
---------+ NET.3.2.A14 Operational Documentation (B)
|
|
|
---------+ NET.3.2.A15 Procuring a Firewall (B)
|
|
|
---------+ NET.3.2.A16 Creation of a “P-A-P” structure (S)
|
|
|
---------+ NET.3.2.A17 Disabling IPv4 or IPv6 (S)
|
|
|
---------+ NET.3.2.A18 Administration Using a Separate Management Network (S)
|
|
|
---------+ NET.3.2.A19 Protection Against TCP SYN Flooding, UDP Packet Storms, and Sequence Number Guessing on the Packet Filter (S)
|
|
|
---------+ NET.3.2.A20 Protection of Fundamental Internet Protocols (S)
|
|
|
---------+ NET.3.2.A21 Temporary Decryption of Data Traffic (S)
|
|
|
---------+ NET.3.2.A22 Secure Time Synchronisation (S)
|
|
|
---------+ NET.3.2.A23 System Monitoring and Evaluation (S)
|
|
|
---------+ NET.3.2.A24 Audits and Penetration Tests (S)
|
|
|
---------+ NET.3.2.A32 Firewall Contingency Planning (S)
|
|
|
---------+ NET.3.2.A25 Advanced Integrity Protection for Configuration Files (H)
|
|
|
---------+ NET.3.2.A26 Outsourcing of Functional Extensions to Dedicated Hardware (H)
|
|
|
---------+ NET.3.2.A27 Use of Different Firewall Operating Systems and Products in Multi-Layer Firewall Architecture (H)
|
|
|
---------+ NET.3.2.A28 Central Filtering of Active Content (H)
|
|
|
---------+ NET.3.2.A29 Use of High-Availability Solutions (H)
|
|
|
---------+ NET.3.2.A30 Bandwidth Management for Critical Applications and Services (H)
|
|
|
---------+ NET.3.2.A31 Use of Certified Products (H)
|
|
|
------+ NET.3.3 VPN
|
|
|
---------+ NET.3.3.G1. Inadequate Planning of VPN Usage
|
|
|
---------+ NET.3.3.G2. Insecure VPN Service Providers
|
|
|
---------+ NET.3.3.G3. Insecure Configuration of VPN Clients for Remote Access
|
|
|
---------+ NET.3.3.G4. Insecure Default Settings on VPN Components
|
|
|
---------+ NET.3.3.A1 Planning the Use of VPNs (B)
|
|
|
---------+ NET.3.3.A2 Selection of an Appropriate VPN Service Provider (B)
|
|
|
---------+ NET.3.3.A3 Secure Installation of VPN End Devices (B)
|
|
|
---------+ NET.3.3.A4 Secure Configuration of a VPN (B)
|
|
|
---------+ NET.3.3.A5 Blocking Unneeded VPN Accounts (B)
|
|
|
---------+ NET.3.3.A6 Analysis of VPN Requirements (S)
|
|
|
---------+ NET.3.3.A7 Planning the Technical VPN Implementation (S)
|
|
|
---------+ NET.3.3.A8 Drawing Up a Security Policy for VPN Usage (S)
|
|
|
---------+ NET.3.3.A9 Selection of Suitable VPN Products (S)
|
|
|
---------+ NET.3.3.A10 Secure Operation of a VPN (S)
|
|
|
---------+ NET.3.3.A11 Secure Integration of an External Network (S)
|
|
|
---------+ NET.3.3.A12 User and Access Management for Remote Access VPNs (S)
|
|
|
---------+ NET.3.3.A13 Integration of VPN Components into a Firewall (S)
|
|
|
------+ NET.4.1 Telecommunications Systems
|
|
|
---------+ NET.4.1.G1. Eavesdropping on Telecommunications Systems
|
|
|
---------+ NET.4.1.G2. Eavesdropping on Rooms using Telecommunications Systems
|
|
|
---------+ NET.4.1.G3. Call Charge Fraud
|
|
|
---------+ NET.4.1.G4. Abuse of Freely Accessible Telephone Extensions
|
|
|
---------+ NET.4.1.A1 Requirements Analysis and Planning for Telecommunications Systems [IT Operation Department] (B)
|
|
|
---------+ NET.4.1.A2 Selection of Telecommunications Service Providers [IT Operation Department] (B)
|
|
|
---------+ NET.4.1.A5 Logging for Telecommunications Systems (B)
|
|
|
---------+ NET.4.1.A6 Creating a Security Policy for Telecommunications Systems [IT Operation Department] (S)
|
|
|
---------+ NET.4.1.A7 Suitable Installation of the Telecommunications System (S)
|
|
|
---------+ NET.4.1.A8 Limitation and Blocking of Unnecessary or Security-Critical Features (S)
|
|
|
---------+ NET.4.1.A9 Training on the Secure Use of Telecommunications Systems [Supervisor] (S)
|
|
|
---------+ NET.4.1.A10 Documentation and Revision of the Telecommunications System Configuration [IT Operation Department] (S)
|
|
|
---------+ NET.4.1.A11 Decommissioning Telecommunications Systems and Devices [IT Operation Department] (S)
|
|
|
---------+ NET.4.1.A12 Backup of Configuration Files (S)
|
|
|
---------+ NET.4.1.A13 Acquisition of Telecommunications Systems (S)
|
|
|
---------+ NET.4.1.A14 Contingency Planning for Telecommunication Systems (S)
|
|
|
---------+ NET.4.1.A15 Emergency Calls in the Event of a Telecommunications System Failure (S)
|
|
|
---------+ NET.4.1.A16 Securing End Devices in Openly Accessible Rooms (S)
|
|
|
---------+ NET.4.1.A17 Maintenance of Telecommunications Systems (S)
|
|
|
---------+ NET.4.1.A18 Increased Access Protection (H)
|
|
|
---------+ NET.4.1.A19 Redundant Connections (H)
|
|
|
------+ NET.4.2 VoIP
|
|
|
---------+ NET.4.2.G1. Incorrect Configuration of VoIP Middleware
|
|
|
---------+ NET.4.2.G2. Incorrect Configuration of VoIP Components
|
|
|
---------+ NET.4.2.G3. Eavesdropping on Telephone Calls
|
|
|
---------+ NET.4.2.G4. Abuse of Freely Accessible Telephone Extensions
|
|
|
---------+ NET.4.2.A1 Planning the Use of VoIP (B)
|
|
|
---------+ NET.4.2.A3 Secure Administration and Configuration of VoIP End Devices (B)
|
|
|
---------+ NET.4.2.A4 Restricting Accessibility via VoIP (B)
|
|
|
---------+ NET.4.2.A5 Secure Configuration of VoIP Middleware (B)
|
|
|
---------+ NET.4.2.A7 Drawing up a Security Policy for VoIP (S)
|
|
|
---------+ NET.4.2.A8 Encryption of VoIP (S)
|
|
|
---------+ NET.4.2.A9 Selection of Suitable VoIP Components (S)
|
|
|
---------+ NET.4.2.A11 Secure Handling of VoIP End Devices [User] (S)
|
|
|
---------+ NET.4.2.A12 Secure Decommissioning of VoIP Components (S)
|
|
|
---------+ NET.4.2.A13 Firewall Requirements When Using VoIP (S)
|
|
|
---------+ NET.4.2.A14 Encryption of Signalling (H)
|
|
|
---------+ NET.4.2.A15 Secure Media Transport Using SRTP (H)
|
|
|
---------+ NET.4.2.A16 Network Separation for Data and VoIP (H)
|
|
|
------+ NET.4.3 Fax Machines and Fax Servers
|
|
|
---------+ NET.4.3.G1. Inadequate or Incorrect Supply of Consumables
|
|
|
---------+ NET.4.3.G2. Fax Transmission Errors
|
|
|
---------+ NET.4.3.G3. Manipulation of Address Books and Distribution Lists
|
|
|
---------+ NET.4.3.G4. Unauthorised Reading of Incoming Fax Transmissions
|
|
|
---------+ NET.4.3.G5. Evaluation of Residual Information in Fax Machines
|
|
|
---------+ NET.4.3.G6. Impersonation of a False Sender on Fax Machines
|
|
|
---------+ NET.4.3.A1 Suitable Siting of a Fax Machine [Building Services] (B)
|
|
|
---------+ NET.4.3.A2 Information for Employees on Using Fax Machines (B)
|
|
|
---------+ NET.4.3.A3 Secure Operation of a Fax Server [IT Operation Department] (B)
|
|
|
---------+ NET.4.3.A4 Drawing Up a Security Policy for Fax Use (S)
|
|
|
---------+ NET.4.3.A6 Procurement of Suitable Fax Machines and Servers [Procurement Department] (S)
|
|
|
---------+ NET.4.3.A7 Suitable Labelling of Outgoing Fax Transmissions [User] (S)
|
|
|
---------+ NET.4.3.A8 Appropriate Disposal of Consumable Fax Accessories and Spare Parts (S)
|
|
|
---------+ NET.4.3.A9 Using Transmission and Reception Logs (S)
|
|
|
---------+ NET.4.3.A10 Control of Programmable Destination Addresses, Logs, and Distribution Lists (S)
|
|
|
---------+ NET.4.3.A11 Preventing Fax Machine Overload [IT Operation Department] (H)
|
|
|
---------+ NET.4.3.A12 Blocking Specific Recipient and Sender Fax Numbers (H)
|
|
|
---------+ NET.4.3.A13 Designating Authorised Fax Operators [User] (H)
|
|
|
---------+ NET.4.3.A14 Producing Copies of Incoming Fax Messages [User] (H)
|
|
|
---------+ NET.4.3.A15 Announcing and Acknowledging Fax Messages [User] (H)
|
|
|
---+ Infrastructure
|
|
|
------+ INF.1 Generic Building
|
|
|
---------+ INF.1.G1. Fire
|
|
|
---------+ INF.1.G2. Lightning
|
|
|
---------+ INF.1.G3. Water
|
|
|
---------+ INF.1.G4. Natural Hazards and Disasters
|
|
|
---------+ INF.1.G5. Threats in the Vicinity
|
|
|
---------+ INF.1.G6. Unauthorised Site Access
|
|
|
---------+ INF.1.G7. Violation of Laws or Regulations
|
|
|
---------+ INF.1.G8. Insufficient Fire Protection
|
|
|
---------+ INF.1.G9. Failure of the Power Supply
|
|
|
---------+ INF.1.A1 Planning the Building Protection [Planner] (B)
|
|
|
---------+ INF.1.A2 Appropriate Segmentation of Circuits (B)
|
|
|
---------+ INF.1.A3 Compliance with Fire Prevention Regulations (B)
|
|
|
---------+ INF.1.A4 Fire Detection in Buildings [Planner] (B)
|
|
|
---------+ INF.1.A5 Hand-Held Fire Extinguishers (B)
|
|
|
---------+ INF.1.A6 Closed Windows and Doors [Employee] (B)
|
|
|
---------+ INF.1.A7 Site Access Regulations and Control [Central Administration] (B)
|
|
|
---------+ INF.1.A8 Smoking Ban (B)
|
|
|
---------+ INF.1.A10 Compliance with Relevant Standards and Regulations [Construction Company, Construction Manager] (B)
|
|
|
---------+ INF.1.A9 Security Concept for Building Use [Planner] (S)
|
|
|
---------+ INF.1.A12 Key Management (S)
|
|
|
---------+ INF.1.A13 Regulations Governing Access to Distributors (S)
|
|
|
---------+ INF.1.A14 Lightning Protection Devices (S)
|
|
|
---------+ INF.1.A15 Plans Detailing the Location of Supply Lines (S)
|
|
|
---------+ INF.1.A16 Avoiding References to the Locations of Sensitive Building Areas (S)
|
|
|
---------+ INF.1.A17 Structural Smoke Protection [Planner] (S)
|
|
|
---------+ INF.1.A18 On-Site Fire Safety Inspections (S)
|
|
|
---------+ INF.1.A19 Notification of the Fire Safety Officer (S)
|
|
|
---------+ INF.1.A20 Alert Plan and Fire Drills (S)
|
|
|
---------+ INF.1.A27 Burglary Protection (S)
|
|
|
---------+ INF.1.A36 Regular Documentation Updates (S)
|
|
|
---------+ INF.1.A22 Secure Doors and Windows (H)
|
|
|
---------+ INF.1.A23 Formation of Security Zones [Planner] (H)
|
|
|
---------+ INF.1.A24 Automatic Drainage (H)
|
|
|
---------+ INF.1.A25 Selection of Appropriate Locations [Top Management] (A)
|
|
|
---------+ INF.1.A26 Gatekeeper or Security Service (H)
|
|
|
---------+ INF.1.A30 Selection of an Appropriate Building (H)
|
|
|
---------+ INF.1.A31 Moving Out of Buildings [Central Administration] (H)
|
|
|
---------+ INF.1.A32 Firestop Seal Register (H)
|
|
|
---------+ INF.1.A34 Intruder and Fire Detection System (H)
|
|
|
---------+ INF.1.A35 Perimeter Protection [Planner, Building Services] (H)
|
|
|
------+ INF.2 Data Centre and Server Room
|
|
|
---------+ INF.2.G1. Incorrect Planning
|
|
|
---------+ INF.2.G2. Insufficient Site Access Controls
|
|
|
---------+ INF.2.G3. Insufficient Monitoring
|
|
|
---------+ INF.2.G4. Insufficient Air Conditioning in a Data Centre
|
|
|
---------+ INF.2.G5. Fire
|
|
|
---------+ INF.2.G6. Water
|
|
|
---------+ INF.2.G7. Insufficient Burglary Protection
|
|
|
---------+ INF.2.G8. Failure of the Power Supply
|
|
|
---------+ INF.2.G9. Contamination
|
|
|
---------+ INF.2.A1 Defining Requirements [Building Services, Planner] (B)
|
|
|
---------+ INF.2.A2 Formation of Fire Zones [Planner] (B)
|
|
|
---------+ INF.2.A3 Use of an Uninterruptible Power Supply [Building Services] (B)
|
|
|
---------+ INF.2.A4 Emergency Shutdown of the Power Supply [Building Services] (B)
|
|
|
---------+ INF.2.A5 Maintenance of Air Temperature and Humidity [Building Services] (B)
|
|
|
---------+ INF.2.A6 Site Access Control [Building Services] (B)
|
|
|
---------+ INF.2.A7 Locking and Securing Facilities [Employee, Building Services] (B)
|
|
|
---------+ INF.2.A8 Use of a Fire Alarm System [Planner] (B)
|
|
|
---------+ INF.2.A9 Use of an Extinguishing or Fire Prevention System [Building Services] (B)
|
|
|
---------+ INF.2.A10 Inspection and Maintenance of Infrastructure [Maintenance Personnel, Building Services] (B)
|
|
|
---------+ INF.2.A11 Automatic Monitoring of Infrastructure [Building Services] (B)
|
|
|
---------+ INF.2.A17 Use of Early Fire Detection [Planner, Building Services] (B)
|
|
|
---------+ INF.2.A29 Avoidance and Monitoring of Unnecessary Wiring [Building Services, Planner] (B)
|
|
|
---------+ INF.2.A12 Data Centre Perimeter Protection [Planner, Building Services] (S)
|
|
|
---------+ INF.2.A13 Planning and Installation of Alarm Systems [Building Services] (S)
|
|
|
---------+ INF.2.A14 Use of an Emergency Power System [Planner, Building Services] (S)
|
|
|
---------+ INF.2.A15 Overvoltage Protection Devices [Planner, Building Services] (S)
|
|
|
---------+ INF.2.A16 Air Conditioning in Data Centres [Planner] (S)
|
|
|
---------+ INF.2.A19 Functional Testing of Technical Infrastructure [Building Services] (S)
|
|
|
---------+ INF.2.A30 Systems for Extinguishing or Preventing Fires [Building Services, Planner] (S)
|
|
|
---------+ INF.2.A21 Alternate Data Centre (H)
|
|
|
---------+ INF.2.A22 Implementation of Dust-Protection Measures [Building Services] (H)
|
|
|
---------+ INF.2.A23 Appropriate Design of Data Centre Cabling [Building Services] (H)
|
|
|
---------+ INF.2.A24 Use of Video Monitoring Systems [Data Protection Officer, Building Services, Planner] (H)
|
|
|
---------+ INF.2.A25 Redundant Design of Uninterruptible Power Supplies [Planner] (H)
|
|
|
---------+ INF.2.A26 Redundant Design of Emergency Power Systems [Planner] (H)
|
|
|
---------+ INF.2.A28 Use of Higher-Level Alarm Systems [Planner] (H)
|
|
|
------+ INF.5 Room or Cabinet for Technical Infrastructure
|
|
|
---------+ INF.5.G1. Incorrect Planning
|
|
|
---------+ INF.5.G2. Unauthorised Site Access
|
|
|
---------+ INF.5.G3. Inadequate Ventilation
|
|
|
---------+ INF.5.G4. Fire
|
|
|
---------+ INF.5.G5. Water
|
|
|
---------+ INF.5.G6. Failure of the Power Supply
|
|
|
---------+ INF.5.G7. Lightning and Overvoltages
|
|
|
---------+ INF.5.G8. Electromagnetic Interference Fields
|
|
|
---------+ INF.5.G9. Electrostatic Discharge
|
|
|
---------+ INF.5.A1 Planning the Room Protection [Planner] (B)
|
|
|
---------+ INF.5.A2 Location and Size of the Technical Infrastructure Room [Planner] (B)
|
|
|
---------+ INF.5.A3 Site Access Regulations and Control [Building Services, IT Operation Department] (B)
|
|
|
---------+ INF.5.A4 Protection Against Intrusion [Planner, Building Services] (B)
|
|
|
---------+ INF.5.A5 Avoidance of and Protection Against Electromagnetic Interference Fields [Planner] (B)
|
|
|
---------+ INF.5.A6 Minimising Fire Loads [Employee, Planner] (B)
|
|
|
---------+ INF.5.A7 Prevention of Incorrect Use [Employee, Planner] (B)
|
|
|
---------+ INF.5.A9 Power Supply [Building Services] (B)
|
|
|
---------+ INF.5.A8 Avoidance of Uncontrolled Electrostatic Discharge [Planner] (S)
|
|
|
---------+ INF.5.A10 Maintenance of Air Temperature and Humidity [Building Services] (S)
|
|
|
---------+ INF.5.A11 Avoidance of Pipes with Hazardous Liquids and Gases [Planner, Building Services] (S)
|
|
|
---------+ INF.5.A12 Protection Against Accidental Damage to Supply Lines [Planner] (S)
|
|
|
---------+ INF.5.A13 Protection Against Fire and Smoke Damage [Planner, Building Services] (S)
|
|
|
---------+ INF.5.A14 Minimising Fire Hazards from Neighbouring Areas [Planner, Building Services] (S)
|
|
|
---------+ INF.5.A15 Lightning and Overvoltage Protection [Planner, Building Services] (S)
|
|
|
---------+ INF.5.A16 Use of an Uninterruptible Power Supply [Building Services] (S)
|
|
|
---------+ INF.5.A17 Inspection and Maintenance of Infrastructure [Building Services, IT Operation Department, Maintenance Personnel] (S)
|
|
|
---------+ INF.5.A18 Location of the Technical Infrastructure Room [Planner] (B)
|
|
|
---------+ INF.5.A19 Redundancy of the Technical Infrastructure Room [Planner] (H)
|
|
|
---------+ INF.5.A20 Enhanced Protection Against Intrusion and Sabotage [Planner] (H)
|
|
|
---------+ INF.5.A22 Redundant Power Supply Design [Planner] (H)
|
|
|
---------+ INF.5.A23 Emergency Power Systems [Planner, Building Services, Maintenance Personnel] (H)
|
|
|
---------+ INF.5.A24 Ventilation and Cooling [Planner, Building Services, Maintenance Personnel] (H)
|
|
|
---------+ INF.5.A25 Increased Protection Against Fire and Smoke Damage [Planner] (H)
|
|
|
---------+ INF.5.A26 Monitoring of the Power Supply [Planner, Building Services] (H)
|
|
|
------+ INF.6 Storage Media Archives
|
|
|
---------+ INF.6.G1. Excessive Temperature and Humidity
|
|
|
---------+ INF.6.G2. Insufficient Rules
|
|
|
---------+ INF.6.G3. Unauthorised Entry to Sensitive Rooms
|
|
|
---------+ INF.6.G4. Theft
|
|
|
---------+ INF.6.A1 Hand-Held Fire Extinguishers [Fire Safety Officer] (B)
|
|
|
---------+ INF.6.A2 Site Access Regulations and Control [Building Services] (B)
|
|
|
---------+ INF.6.A3 Protection Against Dust and Other Contamination (B)
|
|
|
---------+ INF.6.A4 Closed Windows and Locked Doors [Employee] (B)
|
|
|
---------+ INF.6.A5 Using Protective Cabinets [Employee] (S)
|
|
|
---------+ INF.6.A6 Avoidance of Water Pipes [Building Services] (S)
|
|
|
---------+ INF.6.A7 Compliance with Climatic Requirements [Building Services] (S)
|
|
|
---------+ INF.6.A8 Secure Doors and Windows [Planner] (S)
|
|
|
---------+ INF.6.A9 Alarm System [Building Services] (H)
|
|
|
------+ INF.7 Office Workplace
|
|
|
---------+ INF.7.G1. Unauthorised Site Access
|
|
|
---------+ INF.7.G2. Impairment due to Unfavourable Working Conditions
|
|
|
---------+ INF.7.G3. Manipulations by Cleaning Staff, Third-Party Personnel, or Visitors
|
|
|
---------+ INF.7.G4. Manipulation or Destruction of IT, Accessories, Information, or Software in an Office Room
|
|
|
---------+ INF.7.G5. Theft
|
|
|
---------+ INF.7.G6. Exposed Cables
|
|
|
---------+ INF.7.A1 Suitable Selection and Use of an Office Room [Supervisor] (B)
|
|
|
---------+ INF.7.A2 Closed Windows and Locked Doors [Employee, Building Services] (b)
|
|
|
---------+ INF.7.A3 Exposed Cables (S)
|
|
|
---------+ INF.7.A5 Workplace Ergonomics [Central Administration, Supervisor] (S)
|
|
|
---------+ INF.7.A6 Workplace Cleanliness [Employee, Supervisor] (S)
|
|
|
---------+ INF.7.A7 Suitable Storage of Official Documents and Storage Media [Employee, Building Services] (S)
|
|
|
---------+ INF.7.A8 Use of Anti-Theft Devices [Employee] (H)
|
|
|
------+ INF.8 Working from Home
|
|
|
---------+ INF.8.G1. Insufficient Rules for Home Workplaces
|
|
|
---------+ INF.8.G2. Unauthorised Access to Sensitive Rooms of a Home Workplace
|
|
|
---------+ INF.8.G3. Impaired Use of IT due to Adverse Working Conditions at a Home Workplace
|
|
|
---------+ INF.8.G4. Insecure Transport of Files and Storage Media
|
|
|
---------+ INF.8.G5. Inadequate Disposal of Storage Media and Documents
|
|
|
---------+ INF.8.G6. Manipulation or Destruction of IT, Accessories, Information, or Software at a Home Workplace
|
|
|
---------+ INF.8.G7. Higher Risk of Theft at Home Workplaces
|
|
|
---------+ INF.8.A1 Securing Official Documents at the Home Workplace (B)
|
|
|
---------+ INF.8.A2 Transporting Working Material to the Home Workplace (B)
|
|
|
---------+ INF.8.A3 Protection Against Unauthorised Access to the Home Workplace (B)
|
|
|
---------+ INF.8.A4 Suitable Configuration of the Home Workplace (S)
|
|
|
---------+ INF.8.A5 Disposal of Confidential Information at the Home Workplace (S)
|
|
|
---------+ INF.8.A6 Handling Official Documents with Increased Protection Needs at the Home Workplace (H)
|
|
|
------+ INF.9 Mobile Workplace
|
|
|
---------+ INF.9.G1. Insufficient Rules for Mobile Workplaces
|
|
|
---------+ INF.9.G2. Degradation due to Changing Operational Environments
|
|
|
---------+ INF.9.G3. Manipulation or Destruction of IT Systems, Accessories, Information, or Software at a Mobile Workplace
|
|
|
---------+ INF.9.G4. Delays Caused by Temporarily Restricted Availability
|
|
|
---------+ INF.9.G5. Insecure Transport of Files and Storage Media
|
|
|
---------+ INF.9.G6. Inadequate Disposal of Storage Media and Documents
|
|
|
---------+ INF.9.G7. Loss of Confidentiality of Sensitive Information
|
|
|
---------+ INF.9.G8. Theft or Loss of Storage Media or Documents
|
|
|
---------+ INF.9.A1 Appropriate Selection and Usage of a Mobile Workplace [IT Operation Department] (B)
|
|
|
---------+ INF.9.A2 Regulations for Mobile Workplaces [Human Resources Department] (B)
|
|
|
---------+ INF.9.A3 Site and Data Access Protection [Central Administration, Employee] (B)
|
|
|
---------+ INF.9.A4 Working with External IT Systems [IT Operation Department, Employee] (B)
|
|
|
---------+ INF.9.A5 Prompt Reporting of a Loss [Employee] (S)
|
|
|
---------+ INF.9.A6 Disposal of Confidential Information [Employee] (S)
|
|
|
---------+ INF.9.A7 Legal Framework Conditions for Mobile Working [Human Resources Department] (S)
|
|
|
---------+ INF.9.A8 Security Policy for Mobile Workplaces [IT Operation Department] (S)
|
|
|
---------+ INF.9.A9 Encryption of Portable IT Systems and Storage Media [IT Operation Department] (S)
|
|
|
---------+ INF.9.A12 Using a Screen Protector [Employee] (S)
|
|
|
---------+ INF.9.A10 Use of Anti-Theft Devices [Employee] (H)
|
|
|
---------+ INF.9.A11 Prohibiting Use of Insecure Environments [IT Operation Department] (H)
|
|
|
------+ INF.10 Meeting, Event, and Training Rooms
|
|
|
---------+ INF.10.G1. Insufficient Rules
|
|
|
---------+ INF.10.G2. Incompatibility between External and In-House IT Systems
|
|
|
---------+ INF.10.G3. Threats Caused by Visitors
|
|
|
---------+ INF.10.G4. Exposed Cables
|
|
|
---------+ INF.10.G5. Theft
|
|
|
---------+ INF.10.G6. Loss of Confidentiality of Sensitive Information
|
|
|
---------+ INF.10.A1 Secure Use of Meeting, Event, and Training Rooms [Building Services, IT Operation Department] (B)
|
|
|
---------+ INF.10.A3 Closed Windows and Doors [Employee] (B)
|
|
|
---------+ INF.10.A4 Planning Meeting, Event, and Training Rooms (S)
|
|
|
---------+ INF.10.A5 Exposed Cables (S)
|
|
|
---------+ INF.10.A6 Configuring Secure Network Access [IT Operation Department] (S)
|
|
|
---------+ INF.10.A7 Secure Configuration of Training and Presentation Computers [IT Operation Department] (S)
|
|
|
---------+ INF.10.A8 Creating a Proof of Use for Rooms (S)
|
|
|
---------+ INF.10.A9 Resetting Training and Presentation Computers [IT Operation Department] (H)
|
|
|
---------+ INF.10.A10 Ban on Carrying Mobile Phones (H)
|
|
|
------+ INF.11 General Vehicle
|
|
|
---------+ INF.11.G1. Insufficient Rules for Vehicles
|
|
|
---------+ INF.11.G2. Carelessness and Lack of Security Awareness in Handling Vehicles
|
|
|
---------+ INF.11.G3. Unregulated Data Transmission to Third Parties and Insecure Communication Interfaces
|
|
|
---------+ INF.11.G4. Improper Vehicle Modifications
|
|
|
---------+ INF.11.G5. Manipulation, Unauthorised Access, and Theft Involving Vehicles
|
|
|
---------+ INF.11.G6. Dangers in Connection with Maintenance, Repairs, and Updates
|
|
|
---------+ INF.11.G7. Threats During Decommissioning
|
|
|
---------+ INF.11.G8. Unacceptable Temperature and Humidity in Vehicles
|
|
|
---------+ INF.11.A1 Planning and Procurement [Process Owner, Procurement Department, Data Protection Officer] (B)
|
|
|
---------+ INF.11.A2 Maintenance, Inspection, and Updates [Process Owner, IT Operation Department] (B)
|
|
|
---------+ INF.11.A3 Regulations for the Use of Vehicles [IT Operation Department, Process Owner, User, Data Protection Officer] (B)
|
|
|
---------+ INF.11.A4 Creating a Security Policy [Process Owner, IT Operation Department] (S)
|
|
|
---------+ INF.11.A5 Drawing Up a Security Concept (S)
|
|
|
---------+ INF.11.A6 Establishing Instructions [Process Owner, User] (S)
|
|
|
---------+ INF.11.A7 Proper Handling of Vehicles and Sensitive Information [Process Owner, User] (S)
|
|
|
---------+ INF.11.A8 Protection against Weather-Related Influences [User, Process Owner] (S)
|
|
|
---------+ INF.11.A9 Ensuring Fuel Supplies [Process Owner] (S)
|
|
|
---------+ INF.11.A10 Disposal [IT Operation Department, Process Owner] (S)
|
|
|
---------+ INF.11.A11 Replacement Arrangements in the Event of Breakdowns [Process Owner] (H)
|
|
|
---------+ INF.11.A12 Anti-Theft System or Security Guards [Process Owner, Employee] (H)
|
|
|
---------+ INF.11.A13 Damaging Third-Party Interference [Process Owner] (H)
|
|
|
---------+ INF.11.A14 Protection of Sensitive Information from Unauthorised Access and Disclosure [IT Operation Department, Process Owner] (H)
|
|
|
---------+ INF.11.A15 Physical Protection of Interfaces [IT Operation Department, Process Owner] (H)
|
|
|
---------+ INF.11.A16 Fire Extinguishing System [Process Owner] (H)
|
|
|
---------+ INF.11.A17 Network Separation of the In-Vehicle Network with a Special Vehicle Network via Gateways (H)
|
|
|
------+ INF.12 Cabling
|
|
|
---------+ INF.12.G1. Cable Fires
|
|
|
---------+ INF.12.G2. Inadequate Dimensioning of Cabling
|
|
|
---------+ INF.12.G3. Insufficient Documentation on Cabling
|
|
|
---------+ INF.12.G4. Inadequately Protected Distributors
|
|
|
---------+ INF.12.G5. Cable Damage
|
|
|
---------+ INF.12.G6. Voltage Fluctuations, Overvoltage, and Undervoltage
|
|
|
---------+ INF.12.G7. Use of Low-Quality Power Strips
|
|
|
---------+ INF.12.G8. Unauthorised Cable Connections
|
|
|
---------+ INF.12.G9. Impairment of Lines
|
|
|
---------+ INF.12.G10. Eavesdropping and Manipulation of Cables
|
|
|
---------+ INF.12.A1 Selection of Appropriate Cable Types [IT Operation Department, Building Services] (B)
|
|
|
---------+ INF.12.A2 Planning Cable Routing [IT Operation Department, Building Services] (B)
|
|
|
---------+ INF.12.A3 Proper Installation [IT Operation Department, Building Services] (B)
|
|
|
---------+ INF.12.A4 EMC-Compliant Power Supply [Building Services] (B)
|
|
|
---------+ INF.12.A5 Requirements Analysis for Cabling [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A6 Cabling Approval [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A7 Overvoltage Protection [Building Services] (S)
|
|
|
---------+ INF.12.A8 Removing and Disabling Cables No Longer Required [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A9 Fire Prevention in Trays [Building Services] (S)
|
|
|
---------+ INF.12.A10 Documentation and Labelling of Cabling [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A11 Neutral Documentation in Distributors [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A12 Inspection of Electrical Installations and Existing Connections [IT Operation Department, Building Services] (S)
|
|
|
---------+ INF.12.A13 Avoidance of Electrical Ignition Sources [Building Services] (S)
|
|
|
---------+ INF.12.A14 A-B Supply [Building Services] (B)
|
|
|
---------+ INF.12.A15 Material Protection of Cabling [IT Operation Department, Building Services] (H)
|
|
|
---------+ INF.12.A16 Use of Cabinet Systems [Building Services] (H)
|
|
|
---------+ INF.12.A17 Redundancies for IT Cabling [IT Operation Department] (H)
|
|
|
------+ INF.13 Technical Building Management (TBM)
|
|
|
---------+ INF.13.G1. Lack of a Basis for Planning TBM
|
|
|
---------+ INF.13.G2. Lack of Documentation in TBM
|
|
|
---------+ INF.13.G3. Compromised Interfaces with TBM
|
|
|
---------+ INF.13.G4. Inadequate Monitoring of Building Services
|
|
|
---------+ INF.13.G5. Insufficient Role and Authorisation Management
|
|
|
---------+ INF.13.A1 Assessment of the Current Situation When Taking Over Existing Buildings (B)
|
|
|
---------+ INF.13.A2 Regulation and Documentation of Responsibilities and Authorities in the Building [Top Management, Planner] (B)
|
|
|
---------+ INF.13.A3 Documentation of Building Facilities (B)
|
|
|
---------+ INF.13.A4 Creation of a Security Policy for TBM (S)
|
|
|
---------+ INF.13.A5 Planning TBM (S) [Planer]
|
|
|
---------+ INF.13.A6 Drawing Up a TBM Concept (S) [Planner]
|
|
|
---------+ INF.13.A7 Creating a Radio Frequency Register (S)
|
|
|
---------+ INF.13.A8 Creation and Maintenance of an Inventory for TBM (S) [Planner]
|
|
|
---------+ INF.13.A9 Regulation of the Use of Computer-Aided Facility Management (S) [Planner]
|
|
|
---------+ INF.13.A10 Regulation of the Use of Building Information Modelling (S) [Planner]
|
|
|
---------+ INF.13.A11 Adequate Hardening of Systems in TBM (S)
|
|
|
---------+ INF.13.A12 Secure Configuration of TBM Systems (S)
|
|
|
---------+ INF.13.A13 Secure Connection of Restricted Trusted Systems in TBM (S) [Planner]
|
|
|
---------+ INF.13.A14 Consideration of Special Roles and Authorisations in TBM (S)
|
|
|
---------+ INF.13.A15 Protection Against Malware in TBM (S)
|
|
|
---------+ INF.13.A16 Process for Changes in TBM (S)
|
|
|
---------+ INF.13.A17 Provisions for Maintenance and Repairs in TBM (S)
|
|
|
---------+ INF.13.A18 Proactive Maintenance in TBM (S) [Planner]
|
|
|
---------+ INF.13.A19 Conceptualisation and Implementation of Monitoring in TBM (S) [Planner]
|
|
|
---------+ INF.13.A20 Provisions for Event Management in TBM (S) [Planner]
|
|
|
---------+ INF.13.A21 Logging in TBM (S)
|
|
|
---------+ INF.13.A22 Performing System Tests in TBM (S) [Planner]
|
|
|
---------+ INF.13.A23 Integration of TBM into Vulnerability Management (S)
|
|
|
---------+ INF.13.A24 Ensuring Control of Cloud-Based Processes for TBM (S) [Planner]
|
|
|
---------+ INF.13.A25 Establishment of a Test Environment for TBM (H) [Planner]
|
|
|
---------+ INF.13.A26 Securing BIM (H) [Planner]
|
|
|
---------+ INF.13.A27 Establishment of a Private Cloud for TBM (H) [Planner]
|
|
|
---------+ INF.13.A28 Secure Use of Artificial intelligence in TBM (H)
|
|
|
---------+ INF.13.A29 Integration of TBM into SIEM (H) [IT Operation Department]
|
|
|
---------+ INF.13.A30 Performing Penetration Tests in TBM (H)
|
|
|
------+ INF.14 Building Automation and Control Systems (BACS)
|
|
|
---------+ INF.14.G1. Inadequate Planning of BACS
|
|
|
---------+ INF.14.G2. Incorrect Integration of Building Services Systems into BACS
|
|
|
---------+ INF.14.G3. Use of Insecure Systems and Protocols in BACS
|
|
|
---------+ INF.14.G4. Poor Configuration of BACS
|
|
|
---------+ INF.14.G5. Manipulation of Interfaces of Stand-Alone Building Services Systems to BACS
|
|
|
---------+ INF.14.G6. Inadequately Protected Access to BACS
|
|
|
---------+ INF.14.G7. Inadequately Secured BACS Control Elements
|
|
|
---------+ INF.14.G8. Inadequately Secured Mobile Communication Connections
|
|
|
---------+ INF.14.A1 Planning BACS (B) [Planner]
|
|
|
---------+ INF.14.A2 Defining Commissioning and Interface Management for BACS (B)
|
|
|
---------+ INF.14.A3 Secure Connection of Building Services and Building Services Systems (B)
|
|
|
---------+ INF.14.A4 Consideration of Hazard Detection Systems in BACS (B) [Planner]
|
|
|
---------+ INF.14.A5 Documentation of BACS (B)
|
|
|
---------+ INF.14.A6 Separation of BACS Networks (B) [Planner, IT Operation Department]
|
|
|
---------+ INF.14.A7 Drawing Up a Security Policy for BACS (S)
|
|
|
---------+ INF.14.A8 Requirements Specification for BACS (S)
|
|
|
---------+ INF.14.A9 Developing a BACS Concept (S)
|
|
|
---------+ INF.14.A10 Formation of Independent BACS Areas (S) [Planner]
|
|
|
---------+ INF.14.A11 Securing Freely Accessible Ports and Access Points in BACS (S) [Planner]
|
|
|
---------+ INF.14.A12 Use of Secure Transmission Protocols for BACS (S)
|
|
|
---------+ INF.14.A13 Network Segmentation in BACS (S) [Planner]
|
|
|
---------+ INF.14.A14 Use of BACS-Appropriate Access Protection (S)
|
|
|
---------+ INF.14.A15 Security of BACS-Specific Networks (S)
|
|
|
---------+ INF.14.A16 Securing Wireless Communication in BACS Networks (S) [Planner]
|
|
|
---------+ INF.14.A17 Securing Mobile Communications in BACS Networks (S) [Planner]
|
|
|
---------+ INF.14.A18 Secure Integration of BACS-External Systems (S)
|
|
|
---------+ INF.14.A19 Use of Dedicated Address Ranges for BACS Networks (S) [Planner]
|
|
|
---------+ INF.14.A20 Avoiding Broadcast Communication in BACS Networks (S) [Planner]
|
|
|
---------+ INF.14.A21 Displaying Validity of Information in BACS (S)
|
|
|
---------+ INF.14.A22 Ensuring Autonomous Functioning of BACS and Building Services Systems (S) [Planner]
|
|
|
---------+ INF.14.A23 Use of Physically Robust Components for BACS (S) [Planner]
|
|
|
---------+ INF.14.A24 Time Synchronisation for BACS (S)
|
|
|
---------+ INF.14.A25 Dedicated Monitoring in BACS (S)
|
|
|
---------+ INF.14.A26 Logging in BACS (S)
|
|
|
---------+ INF.14.A27 Consideration of Interactions Between BACS Components in Contingency Planning (S)
|
|
|
---------+ INF.14.A28 Physical Separation of BACS (H) [Planner]
|
|
|
---------+ INF.14.A29 Separation of Individual Building Services Systems (H)
|
|
|
---------+ INF.14.A30 Provision of a Dedicated BACS Time Server for Time Synchronisation (H)
|
|