chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
OPS.3.1.A3 Creating a Security Concept for the Outsourcing Project (S)
An outsourcing service provider SHOULD have a security concept for its services. For individual outsourcing projects, it SHOULD also establish specific security concepts based on the respective outsourcing customers' security requirements. Common security objectives SHOULD be developed between outsourcing service providers and their customers. A common classification for all sensitive information SHOULD also be established. Regular checks SHOULD be performed to ensure that the applicable security concepts are implemented.
OPS.3.1.A4 Definition of Possible Communication Partners [Central Administration, Data Protection Officer] (S)
The internal and external communication partners who may transmit and receive specific information on a given outsourcing project SHOULD be defined between the outsourcing service provider and the outsourcing customer. It SHOULD be checked at regular intervals whether the communication partners are still working in their respective roles. The corresponding authorisations SHOULD be adapted in the event of changes. Criteria that determine which communication partners may receive which information SHOULD be specified between the outsourcing partners at hand.
OPS.3.1.A5 Provisions for Deploying the Personnel of Outsourcing Service Providers [Human Resources Department] (S)
The employees of an outsourcing service provider SHOULD be instructed regarding their tasks and informed of outsourcing customers' existing information security regulations. Where required, the outsourcing service provider’s employees SHOULD be vetted in accordance with the customer's requirements (e.g. by means of a certificate of good conduct). The employees of the outsourcing service provider SHOULD be obliged in writing to comply with the relevant laws, regulations, confidentiality agreements, and internal provisions. Deputising arrangements SHOULD be implemented in all areas.
OPS.3.1.A6 Procedures Regarding the Use of Third-Party Personnel [Human Resources Department] (S)
If an outsourcing service provider deploys external personnel, its outsourcing customers SHOULD be informed. External employees with responsibilities related to outsourcing SHOULD also be required in writing to comply with relevant laws, regulations, and internal rules. They SHOULD be briefed on their tasks, and in particular on security specifications. Third-party personnel deployed on short notice (or only once) SHOULD be treated as visitors. However, customers' security specifications SHOULD also be taken into account for third-party personnel.
OPS.3.1.A7 Creation of a Client Separation Concept by an Outsourcing Service Provider (S)
A suitable client separation concept SHOULD ensure that the application and data contexts of different outsourcing customers are separated appropriately. Client separation concepts SHOULD be drawn up by outsourcing service providers and made available to their customers. Client separation concepts SHOULD provide sufficient security for the protection needs of outsourcing customers. The necessary client separation mechanisms SHOULD be implemented sufficiently by outsourcing service providers.
OPS.3.1.A8 Agreements on Connecting to Outsourcing Partner Networks (S)
Before a proprietary network is connected to the network of an outsourcing service provider, all the security-relevant aspects at hand SHOULD be specified in a written agreement. It SHOULD be defined who from one data network may access which areas and services of the other data network. Contact partners SHOULD be appointed on both sides for organisational and technical questions regarding the network connection. All security gaps identified SHOULD be eliminated and the required level of security SHOULD be verifiably achieved before the network connection is activated. In the event of security issues on one or both sides, it SHOULD be specified who must be informed and what escalation steps are to be initiated.
OPS.3.1.A9 Agreement on the Exchange of Data Between Outsourcing Partners (S)
The required security safeguards SHOULD be agreed for the regular exchange of data among fixed communication partners of the outsourcing partners in question. Data formats and a secure form of data exchange SHOULD be defined. Contact persons SHOULD be appointed for organisational and technical questions. Appropriate contact persons SHOULD also be named for security-relevant events that occur when exchanging data with third parties. Availability and response times when exchanging data with third parties SHOULD be agreed. The types of exchanged data that can be used for specific purposes SHOULD also be defined.
ORP.1 Organisation
Target Object: Information domain/generic aspects / Order: R1
ORP.1.A1 Specification of Responsibilities and Provisions [Top Management] (B)
Within an organisation, all relevant tasks and roles MUST be clearly defined and separated from each other. Binding provisions for information security MUST be defined globally for the different operational aspects at hand. The organisational structures and binding regulations MUST be revised when required. All employees MUST be informed of such changes.
ORP.1.A13 Security During Relocation [IT Operation Department, Building Services] (S)
Prior to a relocation, security policies SHOULD be drawn up or updated in good time. All employees SHOULD be informed of the relevant security safeguards before, during, and after the relocation. The items transported SHOULD be checked after relocation to ensure they have all arrived undamaged and unmodified.
ORP.1.A15 Contact Persons for Information Security Issues (B)
In every organisation, there MUST be contact persons for security issues who can answer both seemingly simple and complex questions. These contact persons MUST be known to all the employees of their organisation. Corresponding information MUST be available and easily accessible to everyone in the organisation.
ORP.1.A16 Policy for Secure IT Use [User] (S)
A policy SHOULD be drawn up for all employees which transparently describes the framework conditions that must be observed during IT use and the security safeguards that must be implemented. The policy SHOULD cover the following aspects: • The security objectives of the organisation in question • Important terms • Tasks and roles with respect to information security • Contact persons for questions regarding information security • Security safeguards to be implemented and observed by employees The policy SHOULD be brought to the attention of all users. Every new user SHOULD confirm in writing that they have read and will comply with the policy before being allowed to use information technology. Users SHOULD reconfirm the policy regularly and after major changes. The policy should be made freely available for all staff to read (on the organisation's intranet, for example).
ORP.1.A2 Assigning Responsibilities [Top Management] (B)
For all business processes, applications, IT systems, rooms and buildings, and communication links, the persons responsible for them and their security MUST be defined. All employees MUST be informed accordingly, particularly with regard to what they are responsible for and the related tasks they are to perform.
ORP.1.A3 Supervising or Escorting External Individuals [Employee] (B)
Persons from outside an organisation MUST be escorted to rooms by employees. Employees within the organisation MUST also supervise external persons in sensitive areas. Employees SHOULD be encouraged not to leave external persons unattended within their organisation's premises.
ORP.1.A4 Separation of Roles Between Incompatible Tasks (B)
Tasks and the roles and functions they require MUST be structured in such a way that incompatible tasks (such as operative and controlling roles) are assigned to different persons. The separation of incompatible roles MUST be defined and documented. Representatives MUST also be subject to the separation of roles.
ORP.1.A8 Managing Resources and Devices [IT Operation Department] (S)
All devices and resources that influence information security and are required to perform tasks and comply with security requirements SHOULD be available in sufficient quantities. Suitable verification and approval processes SHOULD take place before these devices and resources are used. Devices and resources SHOULD be listed in appropriate inventories. To prevent the misuse of data, the reliable deletion or destruction of devices and resources SHOULD be regulated (see CON.6 Deleting and Destroying Data and Devices).
ORP.2 Personnel
Target Object: Information domain/generic aspects / Order: R1
ORP.2.A1 Well-Regulated Orientation of New Employees [Supervisor] (B)
An organisation's human resources department and supervisors MUST ensure that employees are provided with orientation regarding their new tasks at the start of their employment. Employees MUST be informed about existing regulations, instructions, and procedures. A corresponding checklist and a direct contact person (mentor) can be helpful and SHOULD be established.
ORP.2.A13 Security Vetting (H)
In high-security areas, additional security vetting beyond the basic verification of employees' trustworthiness SHOULD be carried out. If employees deal with material that is classified as confidential, they SHOULD be subjected to security vetting in line with the German Security Clearance Check Act (SÜG). In this regard, the CISO SHOULD involve their organisation's Confidentiality Officer or Security Representative.
ORP.2.A14 Tasks and Responsibilities of Employees [Supervisor] (B)
All employees MUST be obliged to comply with the relevant laws, regulations, and internal provisions. Employees MUST be aware of the legal framework that governs their work. Employees' tasks and responsibilities MUST be documented in a suitable manner. Furthermore, all employees MUST be informed that all the information they receive during their work is intended for internal use only. Employees MUST be made aware of their obligations to protect their organisation's information security outside of working hours and the organisation's premises.
ORP.2.A15 Qualifications of Personnel [Supervisor] (B)
Employees MUST receive regular training and other opportunities to further their development. In all areas, it MUST be ensured that no employee is working with outdated knowledge. Moreover, employees SHOULD be given the opportunity to acquire new skills within their field of work during their employment. When filling positions, the required qualifications and skills MUST be clearly stated. It SHOULD then be checked whether the job applicants meet these criteria. It MUST be ensured that positions are only filled by qualified employees.
ORP.2.A2 Regulated Procedure for Employees Leaving the Organisation [Supervisor, IT Operation Department] (B)
If an employee leaves an organisation, their successor MUST be briefed in good time, ideally by the departing staff member. If a direct handover is not possible, detailed documentation MUST be prepared by the employee leaving the organisation. Moreover, all documents, keys, and devices, as well as ID cards, badges, and site-access authorisations received in connection with their tasks, MUST be returned by employees leaving an organisation. Before an employee leaves an organisation, they MUST be reminded of their ongoing confidentiality obligations. In particular, it SHOULD be ensured that no conflicts of interest arise. In order to avoid conflicts of interest when someone takes a position at a different organisation, non-competition agreements and waiting periods SHOULD be agreed. Moreover, business continuity plans and other schedules MUST be updated. All the parties affected within the organisation, such as the security personnel or the IT Operation Department, MUST also be informed about the employee leaving the organisation. A checklist SHOULD also be created here to ensure the completion of all the tasks that arise when an employee leaves. In addition, there SHOULD be a permanent contact person from the Human Resources Department who supports the departure procedure for employees.
ORP.2.A3 Defining Deputising Rules [Supervisor] (B)
Supervisors MUST ensure that deputising rules are implemented in day-to-day operations. This MUST be done by ensuring that workable deputising rules are in place for all key business processes and tasks. With respect to these arrangements, a deputy’s scope of tasks MUST be defined clearly in advance. It MUST be ensured that the deputy has the knowledge required for the position in question. If this is not the case, considerations MUST be made as to how the deputy is to be trained or whether it is sufficient to adequately document the current process or project status. Should it prove impossible to appoint or train a competent deputy for individual employees in exceptional cases, it MUST be determined in advance whether external personnel could be called in to act as deputies.
ORP.2.A4 Defining Procedures for Using Third-Party Personnel (B)
If third-party personnel are employed, they MUST be required to comply with applicable laws, regulations, and internal rules in the same way as the employees of the organisation in question. Third-party personnel employed on a short-term or one-off basis MUST be supervised in security-relevant areas. If third-party personnel are engaged for longer periods, however, they MUST be instructed in their tasks in the same way as the organisation's own employees. Deputising rules MUST also be introduced for these employees. If third-party personnel leave the organisation, they MUST follow the same procedures as internal staff with regard to handing over the results of their work and returning any access authorisations they have been issued.
ORP.2.A5 Confidentiality Agreements for Third-Party Personnel (B)
Before external persons are granted data and site access to confidential information, confidentiality agreements MUST be concluded with them in writing. The confidentiality agreements MUST consider all the important aspects relating to the protection of the respective organisation's internal information.
ORP.2.A7 Verifying the Trustworthiness of Employees (S)
New employees SHOULD be screened for trustworthiness before they are hired. Whenever possible, all those involved in the selection process SHOULD check that the information provided by applicants that is relevant to the assessment of their trustworthiness is credible. In particular, careful consideration SHOULD be given to whether submitted CVs are accurate, plausible, and complete. Any information that seems abnormal SHOULD be checked.
ORP.3 Information Security Awareness and Training
Target Object: Information domain/generic aspects / Order: R1
ORP.3.A1 Top Management Awareness of Information Security Issues [Supervisor, Top Management] (B)
An organisation's Top Management MUST be sufficiently aware of security issues. Security campaigns and training activities MUST be supported by the Top Management. The support of the Top Management MUST be obtained before the start of an information security awareness and training program. All Supervisors MUST support information security by setting a good example. Managers MUST implement their organisation's security requirements. In addition, they MUST make their staff aware of their compliance obligations.
ORP.3.A3 Training Employees in the Secure Handling of IT [Supervisor, Human Resources Department, IT Operation Department] (B)
All employees and external users MUST be trained in and made aware of the secure handling of IT, ICS, and IoT components insofar as this is relevant to their work. To this end, binding, clear, and up-to-date policies for the use of the respective components MUST be available. If IT, ICS, or IoT systems or services are used in a manner that runs counter to the interests of the respective organisation, this MUST be communicated.
ORP.3.A4 Designing and Planning an Information Security Awareness and Training Program (S)
Awareness and training programs for information security SHOULD be designed for the appropriate target groups. A requirements analysis should be carried out for this purpose. Training measures SHOULD be able to focus on the specific requirements and different backgrounds. A target-group-oriented awareness and training program SHOULD be created on the topic of information security. This training program SHOULD provide employees with all the information and skills necessary to implement the security rules and safeguards applicable within the organisation in question. It SHOULD be checked and updated regularly.
ORP.3.A6 Implementation of Information Security Awareness and Training Measures (S)
All employees SHOULD receive information security training in line with their tasks and responsibilities.
ORP.3.A7 Training in the IT-Grundschutz Methodology (S)
Chief Information Security Officers SHOULD be familiar with the IT-Grundschutz methodology. Once a need for training has been identified, a suitable IT-Grundschutz training course SHOULD be planned. The BSI's online course on IT-Grundschutz SHOULD be taken into account when planning a training course. Within the training, the approach SHOULD be drilled using practical examples. It SHOULD be examined whether Chief Information Security Officers should be qualified as BSI IT-Grundschutz practitioners.
ORP.3.A8 Measurement and Evaluation of Training Success [Human Resources Department] (S)
The success of information security training SHOULD be measured and evaluated according to the target groups at hand in order to determine the extent to which the objectives set out in awareness and training programs on information security are achieved. The measurements SHOULD consider both quantitative and qualitative aspects of awareness and training programs for information security. The results SHOULD be used appropriately to improve the respective awareness and training program. The Chief Information Security Officer SHOULD exchange information regularly with the Human Resources Department and the other contacts relevant to security (data protection, health and safety, fire prevention, etc) on the effectiveness of training and further development activities.
ORP.3.A9 Special Training for Exposed Persons and Organisations (H)
Particularly exposed persons SHOULD receive in-depth training with regard to possible hazards and appropriate behaviour and precautions.
ORP.4 Identity and Access Management
Target Object: Information domain/generic aspects / Order: R1
ORP.4.A1 Regulation for Creating and Deleting Users and User Groups [IT Operation Department] (B)
Rules MUST be created to define how user IDs and user groups are to be established and deleted. It MUST be possible to associate every user ID with a unique user. User IDs that are inactive for longer periods SHOULD be disabled. All users and user groups MUST ONLY be created and deleted via separate administrative roles. User IDs that are not required, such as guest accounts set up by default or default administrator IDs, MUST be appropriately disabled or deleted.
ORP.4.A10 Protection of User IDs with Wide-Ranging Authorisations [IT Operation Department] (S)
User IDs with broad privileges SHOULD be protected with multi-factor authentication (e.g. cryptographic certificates, chip cards or tokens).
ORP.4.A11 Resetting Passwords [IT Operation Department] (S)
An appropriate and secure procedure SHOULD be defined and implemented for resetting passwords. The support staff members that are able to reset passwords SHOULD be trained accordingly. In case of higher password protection needs, a strategy SHOULD be defined for cases in which a support staff member cannot accept responsibility for providing a password due to the lack of secure options available.
ORP.4.A12 Developing an Authentication Concept for IT Systems and Applications [IT Operation Department] (S)
An authentication concept SHOULD be drawn up that includes a definition of the functional and security requirements of authentication for each IT system and application at hand. Authentication information MUST be stored in a cryptographically secure manner. Authentication information MUST NOT be transmitted unencrypted over insecure networks.
ORP.4.A13 Selection of Suitable Authentication Mechanisms [IT Operation Department] (S)
Identification and authentication mechanisms that meet the protection needs at hand SHOULD be used. Authentication data SHOULD be protected by IT systems and/or applications against espionage, modification, and destruction during processing. IT systems and applications SHOULD increasingly delay further authentication attempts after each unsuccessful attempt. It should be possible to limit the total duration of a login attempt. After the specified number of unsuccessful authentication attempts is exceeded, IT systems and applications SHOULD block the user ID in question.
ORP.4.A14 Checking the Effectiveness of User Separation in IT Systems or Applications [IT Operation Department] (S)
Checks SHOULD be performed at appropriate intervals to ensure that users of IT systems or applications log off regularly after completing their tasks. It SHOULD also be checked that several users are not working under the same ID.
ORP.4.A15 Approach and Design of Identity and Access Management Processes [IT Operation Department] (S)
The following processes SHOULD be defined and implemented for identity and access management: • Policy management • Identity profile management • User ID management • Authorisation profile management • Role management
ORP.4.A16 Policies for Data and System Access Control [IT Operation Department] (S)
A policy for data and system access control SHOULD be drawn up for IT systems, IT components, and data networks. Standard rights profiles that correspond to employees' roles and tasks SHOULD be used. A data access rule SHOULD be established in writing for every IT system and IT application.
ORP.4.A17 Suitable Selection of Identity and Access Management Systems [IT Operation Department] (S)
An organisation's identity and access management system SHOULD be appropriate for its relevant business processes, organisational structures, and workflows, as well as for its protection needs. The identity and access management system SHOULD be able to map the specifications of the organisation for handling identities and authorisations. The identity and access management system chosen SHOULD support the principle of role separation. The identity and access management system SHOULD be adequately protected against attacks.
ORP.4.A18 Using a Central Authentication Service [IT Operation Department] (S)
A central authentication service SHOULD be used to establish central identity and access management. The use of a central network-based authentication service SHOULD be planned carefully. To this end, the security requirements relevant in selecting a service of this kind SHOULD be documented.
ORP.4.A19 Instruction of All Employees in the Handling of Authentication Methods and Mechanisms [User, Head of IT] (S)
All employees SHOULD be instructed in how to properly handle the authentication methods used. There SHOULD be comprehensible policies for handling authentication procedures. Employees SHOULD be informed of the relevant rules in this regard.
ORP.4.A2 Creating, Changing, and Revoking Authorisations [IT Operation Department] (B)
User IDs and authorisations MUST ONLY be granted on the basis of actual need in connection with specific tasks (in line with the least-privilege and need-to-know principles). If there are personnel changes, the user IDs and authorisations that are no longer required MUST be removed. If employees apply for authorisations that are beyond the respective standard, they MUST ONLY be assigned after additional justification and verification are provided. Access permissions to system directories and files SHOULD be restricted. All authorisations MUST be established via separate administrative roles.