chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
INF.1.A35 Perimeter Protection [Planner, Building Services] (H)
Depending on the protection needs and terrain at hand, a building SHOULD have perimeter protection. At minimum, the following components SHOULD be considered in terms of their usefulness and feasibility: • A wall or fence around the property • Security safeguards against accidental trespassing (crossing the property line) • Security safeguards against deliberate trespassing without the use of force • Safeguards to impede the deliberate crossing of the property line through force • Open-air security safeguards • Person and vehicle detection • Safeguards for preserving evidence (e.g. video recording) • Automatic alerts
INF.1.A36 Regular Documentation Updates (S)
The documentation on a building (e.g. construction plans, route plans, wiring diagrams, escape route plans, fire department route maps) SHOULD always be kept up to date. It SHOULD be checked that all the relevant plans are still up to date and correct at least once every three years. Employees SHOULD be informed of any changes.
INF.1.A4 Fire Detection in Buildings [Planner] (B)
Buildings MUST be equipped with a sufficient number of smoke detectors in accordance with the requirements in their construction permits and fire protection concepts. If a local alert at the location of each detector is not sufficient, all detectors MUST be connected to a fire alarm control panel (FACP). If smoke is detected a building, an alarm MUST be triggered. Everyone in the building MUST be able to hear it. The functioning of all smoke detectors and all other components of a fire alarm system MUST be checked regularly.
INF.1.A5 Hand-Held Fire Extinguishers (B)
A sufficient number of suitably dimensioned hand-held fire extinguishers with the fire class required for the situation at hand (based on DIN EN 3, Portable Fire Extinguishers) MUST be available for immediate firefighting measures. These hand-held fire extinguishers MUST be inspected and serviced regularly. Employees SHOULD be instructed in the use of the hand-held fire extinguishers. This instruction SHOULD be repeated at appropriate intervals
INF.1.A6 Closed Windows and Doors [Employee] (B)
Windows and doors accessible from the outside, such as from balconies or terraces, MUST be closed when a room is not occupied. Rooms MUST be locked if confidential information is left there. Corresponding instructions MUST be issued in this regard. All employees SHOULD be required to comply with the instructions. Regular checks MUST be carried out to ensure that windows and internal and external doors are locked after leaving a building. Fire and smoke doors MUST NOT be kept open for extended periods of time unless approved hold-open systems are used.
INF.1.A7 Site Access Regulations and Control [Central Administration] (B)
Access to areas of sensitive buildings and rooms MUST be governed by a policy and controlled. There SHOULD be a concept for site access control. The number of persons with site access authorisation SHOULD be reduced to the bare minimum for every area. Additional persons MUST not gain access until a corresponding need is confirmed. The site access authorisations granted SHOULD be documented. The site access control safeguards MUST be checked regularly for effectiveness. Site access controls SHOULD also remain in place as far as possible during relocations.
INF.1.A8 Smoking Ban (B)
Smoking MUST be prohibited in rooms where fires or contamination could cause considerable damage, such as server rooms or storage media and document archives. Regular checks MUST be carried out to ensure that site access protection is not circumvented when smoking areas are designated or tolerated.
INF.1.A9 Security Concept for Building Use [Planner] (S)
There SHOULD be a security concept for a building's use. The security concept for the building SHOULD be adapted to the overall security concept of the respective organisation. It SHOULD be documented and updated at regular intervals. Sensitive rooms or building areas SHOULD NOT be located in highly exposed or particularly hazardous areas.
INF.10 Meeting, Event, and Training Rooms
Target Object: Building/room / Order: R2
INF.10.A1 Secure Use of Meeting, Event, and Training Rooms [Building Services, IT Operation Department] (B)
The equipment present in such rooms MUST be protected appropriately against theft. Furthermore, the persons who manage the IT and other systems present in such rooms MUST be defined. It MUST also be specified whether visitors may use IT systems they bring along and, if so, under which conditions. Furthermore, the network access points and telecommunications interfaces that can be accessed by visitors MUST be specified.
INF.10.A10 Ban on Carrying Mobile Phones (H)
Mobile phones SHOULD NOT be taken into confidential meetings and conversations. If necessary, this ban SHOULD be enforced by detectors.
INF.10.A3 Closed Windows and Doors [Employee] (B)
The windows MUST be closed when leaving meeting, event, or training rooms. The doors MUST be locked when leaving rooms that contain IT systems or sensitive information. In addition, regular checks MUST be carried out to ensure that the windows and doors have been locked after leaving such rooms. Furthermore, it MUST be ensured that fire doors and smoke control doors are actually closed.
INF.10.A4 Planning Meeting, Event, and Training Rooms (S)
When planning meeting, event, and training rooms, the location of the rooms SHOULD be given special consideration. In particular, rooms often used together with or exclusively by visitors SHOULD NOT be located close to parts of the building where confidential information is regularly processed. The level of confidentiality of the information discussed or processed there SHOULD be specified for each room.
INF.10.A5 Exposed Cables (S)
Power connections SHOULD be placed in locations where projectors, laptops, or other devices requiring electricity are to be set up. Cabling routed over floor surfaces SHOULD be suitably covered.
INF.10.A6 Configuring Secure Network Access [IT Operation Department] (S)
It SHOULD be ensured that the IT systems visitors bring along cannot be connected to a given organisation’s internal IT systems via the data network. Only designated IT systems SHOULD be able to access the organisation's LAN. A data network for visitors SHOULD be kept separate from the organisation's LAN. Network access points SHOULD be configured so that third parties are prevented from reading internal exchanges of data. Network connections in meeting, event, or training rooms SHOULD be safeguarded. The IT systems in meeting, event, and training rooms SHOULD be prevented from establishing simultaneous connections to the intranet and the Internet. Furthermore, the power supply SHOULD be established separately from other rooms from the last sub-distributor.
INF.10.A7 Secure Configuration of Training and Presentation Computers [IT Operation Department] (S)
Dedicated training and presentation computers SHOULD have a minimum configuration. The applications that can be used on the training and presentation computers during each event SHOULD be specified. The training and presentation computers SHOULD only be connected to a separate data network that is isolated from the LAN of the organisation at hand.
INF.10.A8 Creating a Proof of Use for Rooms (S)
Depending on the ways in which meeting, event, and training rooms are used, the persons using the rooms and the corresponding times SHOULD be evident. Proof of use SHOULD also be provided for rooms where training on IT systems or particularly confidential meetings are held. It SHOULD be considered whether corresponding proof of use should also be implemented for rooms that are accessible to every employee.
INF.10.A9 Resetting Training and Presentation Computers [IT Operation Department] (H)
A procedure for resetting training and presentation computers to a pre-defined state after use SHOULD be specified. Changes made by users SHOULD be removed completely in such cases.
INF.11 Generic Vehicle
Target Object: Building/room / Order: R3
INF.11.A1 Planning and Procurement [Process Owner, Procurement Department, Data Protection Officer] (B)
The intended use of a vehicle MUST be planned before the vehicle is procured. The functional requirements for vehicles and, in particular, the requirements for information security and data protection of the IT components installed in them MUST be determined. The following aspects MUST be taken into account: • Operational scenarios of the vehicles • The immediate operational environment of the vehicles • The entire lifecycle of the vehicles The vehicles MUST also have adequate locking systems unless they can be continuously secured by other safeguards or arrangements. During planning, consideration SHOULD be given to the fact that many vehicles can transmit data to the vehicle manufacturer and other third parties.
INF.11.A10 Disposal [IT Operation Department, Process Owner] (S)
When vehicles are decommissioned, no sensitive information SHOULD remain in them. Before vehicles are decommissioned for the last time, the corresponding inventory list SHOULD be used to check that no inventoried items or any other relevant objects have been left behind.
INF.11.A11 Replacement Arrangements in the Event of Breakdowns [Process Owner] (H)
Preparatory safeguards SHOULD be taken within the organisation in question in case there is a problem with a driver or a vehicle. Depending on the importance of vehicles, replacement vehicles SHOULD be available. Alternatively, a framework agreement SHOULD be concluded with a suitable external organisation. Replacement drivers SHOULD also be available.
INF.11.A12 Anti-Theft System or Security Guards [Process Owner, Employee] (H)
An alarm system SHOULD be in place. Land-based vehicles SHOULD also have an immobiliser. If a vehicle is abandoned, the alarm and immobiliser SHOULD be activated. Alternatively, vehicles SHOULD be guarded.
INF.11.A13 Damaging Third-Party Interference [Process Owner] (H)
Depending on the type of vehicle, appropriate safeguards SHOULD be taken to protect vehicles from potential third-party interference (such as radio interference) in the planned operational environment.
INF.11.A14 Protection of Sensitive Information from Unauthorised Access and Disclosure [IT Operation Department, Process Owner] (H)
Vehicles and their IT components SHOULD be secured in such a way that sensitive information cannot be read, manipulated, or deleted by unauthorised persons. In this context, the manufacturer safeguards SHOULD be checked and adapted if necessary.
INF.11.A15 Physical Protection of Interfaces [IT Operation Department, Process Owner] (H)
All internal and external physical interfaces of vehicles SHOULD be physically secured against unauthorised use and external influences.
INF.11.A16 Fire Extinguishing System [Process Owner] (H)
Vehicles SHOULD have a fire extinguishing system capable of extinguishing a fire from the outside and inside. Alternatively, suitable fire-fighting equipment SHOULD be stored in vehicles.
INF.11.A17 Network Separation of the In-Vehicle Network with a Special Vehicle Network via Gateways (H)
In general, an organisation SHOULD ensure that no information is exchanged in an unauthorised and undefined manner between • in-vehicle networks (IVNs, which are typically connected to the networks of vehicle manufacturers) and • mission-specific IT components. Gateways with standardised protocols (e.g. in line with Standard CiA 447) SHOULD be used for this purpose. The gateways SHOULD be approved by the vehicle manufacturer.
INF.11.A2 Maintenance, Inspection, and Updates [Process Owner, IT Operation Department] (B)
Vehicles and their IT components MUST be maintained in line with the manufacturer's specifications. This MUST take into account that conventional maintenance intervals may not correspond to the updates provided for integrated IT components. Those who are allowed to install such updates MUST be clearly defined along with the environment required for this purpose. Over-the-air (OTA) updates MUST also be installed in a regulated manner. Maintenance and repair work MUST be carried out by authorised and qualified personnel in a secure environment. The manner in which external companies are to be dealt with SHOULD be clarified prior to such maintenance. If vehicle maintenance takes place at external organisations, checks SHOULD be carried out to ensure that all the unnecessary portable IT systems belonging to the vehicle are removed. When vehicles are put back into operation, a checklist MUST be used to verify that all the complaints and deficiencies in question have been rectified. The functionality of the IT components involved MUST also be checked.
INF.11.A3 Regulations for the Use of Vehicles [IT Operation Department, Process Owner, User, Data Protection Officer] (B)
Before any activity is carried out in a vehicle that may have an impact on the security of the information processed in the vehicle, it MUST be determined whether the activity is permissible. In this context, the information that may be transported and processed MUST be clearly regulated. In addition, the protective safeguards to be taken MUST be specified. This MUST apply to any kind of information, including that which is exchanged in conversations in vehicles. The framework conditions that are required for employees to access specific types of information at their organisation MUST be clarified. Furthermore, the extent to which infotainment systems, applications, and other vehicle services may be used MUST be regulated. The manner in which interfaces are to be secured MUST also be specified. Existing business and service directives MUST describe how IT carried in vehicles may be used and stored.
INF.11.A4 Creating a Security Policy [Process Owner, IT Operation Department] (S)
All the security requirements relevant to IT within vehicles SHOULD be documented in a security policy that is mandatory for employees. The policy SHOULD be known to all the relevant employees in the organisation in question and should form the basis of their handling of vehicles. The policy SHOULD clearly define responsibilities for individual tasks. The security policy SHOULD be reviewed and updated as appropriate.
INF.11.A5 Creating an Inventory List (S)
For each vehicle, an inventory list SHOULD be drawn up that contains the following: • The IT components permanently installed or associated with the vehicle (e.g. handheld radios in emergency vehicles) • The specialised procedures that are executed on the vehicle's integrated IT components • Instructions and operational documentation • The mobile devices linked to the infotainment system The inventory list SHOULD be updated regularly and as appropriate. It SHOULD be checked that all inventoried IT components belonging to the vehicle are still present. In addition, the inventory list SHOULD be used to check that no mobile devices have been connected to the infotainment system without authorisation.
INF.11.A6 Establishing Instructions [Process Owner, User] (S)
Instructions in the form of checklists SHOULD be available for all the fundamental situations related to vehicle information security. The instructions SHOULD be integrated into the corresponding security policy and made available in suitable checklists while the vehicle in question is in use. This SHOULD also account for the possibility that the vehicle may be stolen. In particular, the instructions SHOULD address the following scenarios: • Failure of vehicle IT components • Emergency situations such as accidents • Unauthorised vehicle entry • Theft of a vehicle or objects stored therein that are relevant to information security The responsibilities for each task SHOULD be documented in the checklists. The instructions SHOULD be followed by vehicle users in the corresponding situations. The checklists SHOULD be used to document how users proceeded in such situations.
INF.11.A7 Proper Handling of Vehicles and Sensitive Information [Process Owner, User] (S)
An organisation SHOULD supplement its instructions on vehicle use with guidelines on when, how, and where vehicles may be parked or docked properly. These guidelines SHOULD mainly define environments that adequately protect vehicles from unauthorised access or damage. Furthermore, the information and IT systems that may be kept in vehicles SHOULD be considered. Sufficient safeguards SHOULD be taken to protect access. Vehicle cargo SHOULD be securely stowed. It SHOULD be ensured that sensitive information cannot be viewed, overheard, or stolen by unauthorised persons from outside vehicles. Employees SHOULD be made aware of the basic operation of vehicles and the IT components involved. Employees SHOULD also be informed of the security risks at hand.
INF.11.A8 Protection against Weather-Related Influences [User, Process Owner] (S)
Vehicles and the IT components installed in them SHOULD be adequately protected against weather-related influences. Additional protective safeguards SHOULD be taken depending on the type of vehicle, location, and operational environment. Appropriate protective safeguards SHOULD be taken to address extreme weather conditions that occur at short notice. These protective safeguards SHOULD be documented in the form of checklists in instructions on vehicle use.
INF.11.A9 Ensuring Fuel Supplies [Process Owner] (S)
Before vehicles are deployed, the manner in which they will be supplied with fuel during operations SHOULD be planned. Vehicles SHOULD always be sufficiently supplied with fuel during operations.
INF.12 Cabling
Target Object: Building/room / Order: R2
INF.12.A1 Selection of Appropriate Cable Types [IT Operation Department, Building Services] (B)
When selecting cable types, the necessary transmission features MUST be checked. The relevant standards and regulations MUST be observed. The environmental conditions present during operation and installation MUST also be taken into account. With regard to environmental conditions, the following factors MUST be considered: • Temperatures • Cable paths • Tensile forces during installation • Type of installation • Distance between end points and possible sources of interference
INF.12.A10 Documentation and Labelling of Cabling [IT Operation Department, Building Services] (S)
An organisation SHOULD ensure that it has internal and external documentation for its cabling. The internal documentation MUST include all records on the installation and operation of the cabling. The internal documentation SHOULD be comprehensively produced and maintained in such a way that operations and further development are supported as effectively as possible. The external documentation (labelling of connections to support operations) of the cabling SHOULD be kept as neutral as possible. Every change in the network SHOULD be documented. An interim or working version of the documentation SHOULD be adapted immediately (i.e. on the same day as a given change). The master documentation MUST be updated no later than four weeks after completion of the respective work. Whether a document management system can be used for the documentation SHOULD be checked. The documentation SHOULD be reviewed and updated regularly. All technical equipment documented within the scope of cabling MUST be checked with regard to documentation compliance after four years at the latest.
INF.12.A11 Neutral Documentation in Distributors [IT Operation Department, Building Services] (S)
There SHOULD be documentation in every distributor that reflects the current marshalling and line assignments. The documentation in the distributor MUST enable safe switching. The documentation in the distributor SHOULD be kept as neutral as possible. The documentation in the distributor SHOULD only list existing and used connections and accumulating reserve cables. If possible, no references to the way cables are used SHOULD be given. References SHOULD be limited to those that are expressly prescribed. All further information SHOULD be provided in review documentation.
INF.12.A12 Inspection of Electrical Installations and Existing Connections [IT Operation Department, Building Services] (S)
All electrical installations and equipment SHOULD be inspected regularly according to DGUV Vorschrift 3 [DGUV Regulation 3] in line with the implementation instructions mentioned in section 5, Tests. Any irregularities detected MUST be documented immediately. Any irregularities detected MUST also be reported immediately to the responsible organisational units. The responsible organisational units MUST remedy the detected irregularities promptly enough to ensure there is no threat to people. The availability of the electrical installations and equipment MUST be ensured to the extent they are required.
INF.12.A13 Avoidance of Electrical Ignition Sources [Building Services] (S)
The use of electrical appliances and equipment intended for private use SHOULD be clearly regulated within an organisation. All electrical equipment MUST be tested and deemed safe by a qualified electrician before it is used. The use of power strips SHOULD be avoided whenever possible. If additional sockets are required, they SHOULD be professionally retrofitted by a qualified electrician.
INF.12.A14 A-B Supply [Building Services] (B)
Instead of a single-line power supply, a two-line A-B supply SHOULD be considered to supply important IT components and other consumers. The functionality of the power supply SHOULD be continuously monitored by suitable technical equipment.
INF.12.A15 Material Protection of Cabling [IT Operation Department, Building Services] (H)
Consideration SHOULD be given to securing cables and distributors against unauthorised access in all rooms of a building, especially in rooms frequented by the public and in areas that are difficult to see. In any case, the number and extent of places where power supply equipment and data network access points are accessible to unauthorised persons SHOULD be minimised.
INF.12.A16 Use of Cabinet Systems [Building Services] (H)
Electrical connections and distributors SHOULD be placed or built into cabinet systems. The dimensioning of the cabinet systems SHOULD take into account the growth expected for the planned period of use.
INF.12.A17 Redundancies for IT Cabling [IT Operation Department] (H)
Consideration SHOULD be given to creating redundant primary IT cabling that is routed through independent trays. Whether or not redundant connections to IT or telecommunication providers should be installed SHOULD also be examined. In case of high or very high availability requirements, consideration SHOULD be given to installing redundant secondary and tertiary cabling in the relevant buildings. Redundantly designed parts of the secondary cabling SHOULD be routed through different fire zones. If redundant cabling is used, its proper functioning SHOULD be checked at regular intervals.
INF.12.A2 Planning Cable Routing [IT Operation Department, Building Services] (B)
Cables, cable routes, and cable trays MUST be dimensioned adequately from both a functional and a physical perspective. In this respect, future requirements MUST also be taken into account, such as sufficient space for possible technical expansions in cable channels and trays. When routing IT and power cabling together in a tray, crosstalk MUST also be prevented among the individual cables. Care MUST be taken to ensure that IT cabling and electrical cabling are routed with the amount of separation specified in the relevant standards. Cables MUST be routed to avoid identifiable sources of risk.
INF.12.A3 Proper Installation [IT Operation Department, Building Services] (B)
Installation work on cabling MUST be carried out competently and carefully. All the relevant standards MUST be observed during installation. A person with corresponding expertise MUST check that cabling is installed properly at all stages. Whether the right cables and connection components have been delivered MUST be checked at the time of delivery. Care MUST be taken to ensure that the installation does not cause any damage. In addition, the cable routes MUST be chosen in a way that prevents the installed cables from being damaged by normal use of the surrounding building.