chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
CON.2.A1 Implementing the German Standard Data Protection Model (B)
Compliance with the legal provisions on data protection MUST be ensured at the EU, federal, and state levels (GDPR, BDSG, and LDSG). If the SDM methodology is not taken into account (i.e. the safeguards are not systematised on the basis of the protection goals and compared with the SDM reference safeguards catalogue), this SHOULD be justified and documented.
CON.3 Backup Concept R1 Information domain/generic aspects
Target Object: Information domain/generic aspects / Order: R1
CON.3.A1 Determining the Factors That Influence Backups [Process Owner, IT Operation Department] (B)
The IT Operation Department MUST ascertain the framework conditions for backups of each IT system and the applications executed on them. For this purpose, the IT Operation Department MUST consult the Process Owners for the applications and the persons responsible for the respective IT systems. The IT Operation Department MUST consider at least the following framework conditions: • Storage space • Change volumes • Changing times • Availability requirements • Integrity requirements • Legal requirements The results MUST be recorded in a clear and appropriate manner. New requirements MUST be considered promptly.
CON.3.A10 Employee Obligations Regarding Backups (S)
All employees SHOULD be informed of their organisation's backup regulations. They SHOULD also be informed of the tasks they are to perform in the creation of backups. Employees SHOULD be required to carry out backups.
CON.3.A11 Backup Copies of Software in Use [IT Operation Department] (S)
The IT Operation Department SHOULD make backup copies of software programs in use, provided this is legally permitted and technically possible. In this regard, all the packages and information necessary to quickly reinstall software in an emergency SHOULD be available. The original installation sources and the licence numbers SHOULD be stored in a secure location.
CON.3.A12 Suitable Storage of Backup Storage Media [IT Operation Department] (S)
The IT Operation Department SHOULD store backup media appropriately to prevent unauthorised access. Such media SHOULD be kept physically separate from the backed-up IT systems. The storage location SHOULD be air-conditioned in such a way that the storage media can be stored for the amount of time specified in the backup concept.
CON.3.A13 Using Cryptographic Methods for Backups [IT Operation Department] (H)
The IT Operation Department SHOULD encrypt all backups to ensure the confidentiality and integrity of backed-up data. It SHOULD be ensured that the encrypted data can be restored even after extended periods of time. The cryptographic keys used SHOULD be protected by a separate backup.
CON.3.A2 Establishment of Backup Procedures [Process Owner, IT Operation Department] (B)
The IT Operation Department MUST establish a procedure for each IT system that defines what data is backed up and how. In virtual environments, it SHOULD be checked whether the system can be backed up by means of snapshot mechanisms. A backup procedure MUST define the type, frequency, and times of backups. This MUST be based on the influencing factors that have been determined and involve the Process Owners of the respective applications. The storage media to be used and the manner in which they are to be transported and stored MUST also be defined.
CON.3.A4 Creating a Minimum Backup Concept [IT Operation Department] (B)
The IT Operation Department MUST create a minimum backup concept based on the defined backup procedure at hand. This concept MUST define the minimum backup requirements to be met by the IT Operation Department. The minimum backup concept MUST contain at least short descriptions of the following: • The IT systems and data to be included in each backup • How the backups can be created and restored • The parameters to be selected • The hardware and software to be used
CON.3.A5 Regular Backups [IT Operation Department] (B)
The IT Operation Department MUST create regular backups in line with the (minimum) backup concept. The backups created MUST be suitably protected against third-party access. Tests MUST be performed regularly to determine whether the backup process is working as desired, and especially whether the backed-up data can also be restored without any problems and within an appropriate period of time.
CON.3.A6 Developing a Backup Concept [Process Owner, IT Operation Department] (S)
The IT Operation Department SHOULD create a backup concept based on the minimum backup concept. This SHOULD include the following points at minimum: • Definitions of essential aspects of backups (e.g. types of data to be differentiated) • Threat landscape • Influencing factors for each IT system • A backup plan for each IT system • Relevant findings from business continuity management, in particular the recovery point objective (RPO) for each IT system The IT Operation Department SHOULD coordinate the backup concept with the Process Owners responsible for the applications affected. Employees SHOULD be informed about the part of the backup concept that concerns them. The proper implementation of the backup concept SHOULD be checked regularly.
CON.3.A7 Procuring a Suitable Backup System [IT Operation Department] (S)
Before procuring a backup system, the IT Operation Department SHOULD create a requirements list to evaluate the products available on the market. The backup system purchased SHOULD meet the requirements of the backup concept and the overall security concept of the organisation in question.
CON.3.A9 Prerequisites of Online Backups [IT Operation Department] (S)
If online storage is used for backups, the following points SHOULD be regulated at minimum: • How the corresponding contract is formulated • Where the data is stored • Service level agreements (SLAs), particularly in terms of availability • Appropriate authentication methods • Encryption of data stored online • Transport encryption
CON.6 Deleting and Destroying Data and Devices R1 Information domain/generic aspects
Target Object: Information domain/generic aspects / Order: R1
CON.6.A1 Regulations for Deleting or Destroying Information [Central Administration, Process Owner, Data Protection Officer, IT Operation Department] (B)
An organisation MUST regulate the deletion and destruction of information. In doing so, the Process Owners for each specialised procedure or business process MUST specify which information must be deleted and disposed of under which conditions. They MUST consider legal provisions that: • Define the minimum retention periods • Guarantee the maximum retention periods and the right to the secure deletion of personal data If personal data is involved, the regulations for deleting and destroying personal data MUST be coordinated with the Data Protection Officer. The deletion and destruction of information MUST be regulated for specialised procedures, business processes, and IT systems before they are used productively.
CON.6.A11 Deletion and Destruction of Storage Media by External Service Providers (B)
If external service providers are commissioned, the process for deletion and destruction MUST be sufficiently secure and transparent. The procedures used by an external service provider for secure deletion and destruction MUST at least meet the corresponding organisation’s internal requirements for deletion and destruction procedures. Those commissioned with deletion and destruction SHOULD be regularly audited to ensure that their operations are still proceeding correctly.
CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B)
An organisation MUST implement the following minimum procedures for deleting and destroying sensitive storage media. These procedures SHOULD be reviewed and adapted as necessary, depending on the protection needs of the data being processed. • Rewritable digital media that are not encrypted during use MUST be completely overwritten with a data stream of random values (e.g. a PRNG stream). • If encrypted digital media are used, they MUST be erased through secure deletion of the corresponding key in compliance with the respective crypto concept. • Optical storage media MUST be destroyed in accordance with security level O-3 (at minimum) as defined in ISO/IEC 21964-2. • Smartphones and other smart devices SHOULD be encrypted in line with the crypto concept in question. Smartphones and other smart devices MUST be reset to factory settings. The setup process SHOULD then be carried out to complete the deletion. • IoT devices MUST be reset to factory settings. All the credentials stored in such devices MUST then be changed. • Paper MUST be destroyed in accordance with security level P-3 (at minimum) as defined in ISO/IEC 21964-2. • Storage media integrated in other devices MUST be securely erased via the devices' integrated functions. If this is not possible, the mass storage components MUST be removed and either securely erased like conventional digital media from a separate IT system, or destroyed in accordance with security level E-3 or H-3 (at minimum) as specified in ISO/IEC 21964-2.
CON.6.A13 Destruction of Defective Digital Storage Media (S)
If, due to a defect, digital storage media containing sensitive information cannot be securely deleted in accordance with the applicable procedures for deleting storage media, they SHOULD be destroyed in accordance with security level 3 (at minimum) of ISO/IEC 21964-2. In the event that defective storage media are replaced or repaired instead, it SHOULD be contractually agreed with the service provider contracted for this purpose that these media will be securely deleted or destroyed by the service provider. The service provider's procedures SHOULD at least meet the organisation's internal requirements for deletion and destruction procedures.
CON.6.A14 Destruction of Storage Media at Increased Security Levels (H)
An organisation SHOULD determine the security level required for the destruction of its storage media in accordance with ISO/IEC 21964-1 based on the protection needs of the media to be destroyed. The media SHOULD be destroyed in accordance with the assigned security level outlined in ISO/IEC 21964-2.
CON.6.A2 Proper Deletion and Destruction of Sensitive Resources and Information (B)
Sensitive information and storage media MUST be securely deleted or destroyed prior to disposal. The process for this MUST be clearly regulated. Individual employees MUST be informed of the tasks they need to perform for secure deletion and destruction. The process for deleting and destroying storage media MUST also take account of backups when necessary. The location of destruction facilities on an organisation's premises MUST be clearly regulated. In this regard, it MUST be considered that information and resources may be collected first and only deleted or destroyed later. A central collection point of this kind MUST be protected against unauthorised access.
CON.6.A4 Selecting Suitable Methods for Deleting or Destroying Storage Media (S)
An organisation SHOULD verify that the minimum requirements for deletion and destruction procedures (see CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures) are sufficiently secure for the media and information actually used. Based on its findings, the organisation SHOULD determine appropriate procedures for deletion and destruction of each storage media. For all the types of storage media the organisation uses and deletes or destroys itself, there SHOULD be suitable devices and tools with which the responsible employees can delete or destroy stored information. The selected procedures SHOULD be known to all the employees responsible. The organisation SHOULD regularly check that the selected methods still correspond to the state of the art and are sufficiently secure for its purposes.
CON.6.A8 Creating a Policy for Deleting and Destroying Information [Employee, IT Operation Department, Data Protection Officer] (S)
An organisation SHOULD document its regulations regarding deletion and destruction in a policy. The policy SHOULD be known to all the relevant employees of the organisation and represent the basis for their actions and work. In terms of its content, the policy SHOULD include all employed storage media, applications, IT systems, and other resources and information that are subject to deletion and destruction. Employee compliance with the policy SHOULD be checked regularly and at random. The policy SHOULD be updated at regular intervals.
CON.7 Information Security on Trips Abroad R3 Information domain/generic aspects
Target Object: Information domain/generic aspects / Order: R3
CON.7.A1 Information Security Policy for Trips Abroad (B)
All aspects which are relevant to information security in connection with working abroad MUST be considered and regulated. The security safeguards taken in this regard MUST be documented in an information security policy for trips abroad. The security policy or an instruction leaflet detailing the security safeguards to be observed MUST be handed out to employees who work in different countries. In addition, a security concept for handling portable IT systems on trips abroad MUST be established that describes all the security requirements and safeguards in sufficient detail. The implementation of the security concept MUST be checked at regular intervals.
CON.7.A10 Encryption of Portable IT Systems and Storage Media [User, IT Operation Department] (B)
To ensure that sensitive information cannot be accessed by unauthorised third parties, employees MUST ensure that all sensitive information is secured in accordance with the applicable internal policies before travelling. Mobile storage media and clients SHOULD be encrypted by the user or the IT Operation Department prior to travel. The cryptographic keys MUST be stored separately from encrypted devices. When encrypting data, the legal regulations of the destination country SHOULD be observed. In particular, country-specific laws on the issuance of passwords and the decryption of data SHOULD be considered.
CON.7.A11 Use of Anti-Theft Devices [User] (S)
To protect mobile IT systems outside their organisation, users SHOULD use anti-theft devices, particularly in places where there is increased public traffic or high user fluctuation. The procurement and usage criteria for anti-theft devices SHOULD be adapted to each organisation’s processes and documented accordingly.
CON.7.A12 Secure Destruction of Sensitive Materials and Documents [User] (B)
Organisations MUST present employees with options for appropriately and securely destroying sensitive documents. Users MUST comply with these regulations. They MUST NOT dispose of their organisation's internal records until they have been securely destroyed. If this is not possible locally or it involves dealing with documents or storage media containing particularly sensitive information, these items MUST be kept until the employee’s return from business travel and then appropriately destroyed.
CON.7.A13 Transporting Necessary Data and Storage Media [User] (S)
Before beginning a trip, employees SHOULD check what data is not absolutely required on the IT systems they are taking with them (notebook, tablet, smartphone, etc). Any data that does not need to be left on a device SHOULD be securely deleted. However, if it is necessary to take sensitive data on trips, this SHOULD only be done in encrypted form. In addition, the mobile storage media that may be taken on trips abroad and the corresponding security safeguards that SHOULD be taken into account (e.g. protection against malware, encryption of business critical data, safekeeping of mobile storage media) SHOULD be established in writing. Employees SHOULD know and follow these regulations before beginning a trip. These security-related requirements SHOULD vary depending on the protection needs of the data to be handled abroad and the data to be accessed.
CON.7.A14 Cryptographically Secured E-Mail Communication [User, IT Operation Department] (S)
Employees SHOULD secure e-mail-based communications cryptographically in accordance with their organisation’s internal provisions. E-mails SHOULD also be suitably encrypted or digitally signed. Public IT systems, such as those in hotels or Internet cafés, SHOULD not be used for accessing e-mails. For communication via e-mail services (e.g. webmail), organisations SHOULD clarify in advance what security mechanisms are implemented by the respective providers and whether they satisfy its internal security requirements. These include, for example, secure server operation, the establishment of an encrypted connection, and the duration of data storage.
CON.7.A15 Emission Security for Portable IT Systems (H)
Before the beginning of a trip, the protection needs of the particular information to be handled on the employee’s mobile storage media or client while abroad SHOULD be determined. The corresponding organisation SHOULD check whether the information to be taken has a special need for protection and use low-radiation or radiation-proof storage media and clients accordingly.
CON.7.A16 Protecting Integrity Using Checksums or Digital Signatures [User] (H)
Users SHOULD use checksums to verify the integrity of data during transmission and backups. To achieve an even better level of protection in safeguarding the integrity of sensitive information, digital signatures SHOULD be used.
CON.7.A17 Use of Dedicated Travel Hardware [IT Operation Department] (H)
To ensure that an organisation's sensitive information cannot be accessed by third parties while travelling abroad, the IT Operation Department SHOULD provide employees with pre-configured travel hardware. On the basis of the minimum principle, this travel hardware SHOULD only provide the functions and information which are absolutely necessary to conduct business activities.
CON.7.A18 Restricted Authorisations on Trips Abroad [IT Operation Department] (H)
Before the beginning of a trip, the authorisations the employee in question truly needs in order to conduct their day-to-day business while abroad SHOULD be checked. To this end, the option to have the IT Operation Department withdraw the employee's access rights for the duration of the trip in order to prevent unauthorised access to information within the organisation SHOULD be considered.
CON.7.A2 Raising Employee Awareness of Information Security When Travelling Abroad (B)
Users MUST be made aware of and receive training in the responsible handling of information technology and portable IT systems on trips abroad. Users MUST be aware of the dangers that can arise from inappropriate handling of information, improper destruction of data and storage media, or malware and insecure data exchanges. The limits of the security safeguards in use MUST also be demonstrated. Users MUST be empowered and encouraged to prevent loss or theft or to seek professional advice in case of inconsistencies. In addition, the legal requirements for individual destinations in relation to travel security SHOULD be emphasised to employees. The Chief Information Security Officer MUST keep abreast of legal requirements in the context of information security (e.g. data protection, IT security law) and raise employee awareness in this regard.
CON.7.A3 Identification of Country-Specific Regulations, Travel Conditions, and Environmental Conditions [Human Resources Department] (B)
Prior to travel, the applicable regulations of each country MUST be reviewed by the respective organisation's information security managers or Human Resources Department and communicated to the relevant staff. The organisation MUST establish, implement, and communicate appropriate policies and safeguards that enable the adequate protection of internal data. Individual travel- and environmental conditions MUST be taken into account. Before the beginning of a trip, employees MUST also familiarise themselves with the climatic conditions in the destination country and determine the protective safeguards they require for themselves (e.g. vaccinations) and the information technology they plan to take.
CON.7.A4 Use of Privacy Screens [User] (B)
Particularly when abroad, users MUST ensure that no sensitive information can be spied on when they are working on mobile devices. To this end, appropriate privacy screens which cover the entire screen of each device and thwart information espionage MUST be used.
CON.7.A5 Use of Screen/Code Locking [User] (B)
A screen or code lock that prevents third parties from accessing mobile device data MUST be used. The user MUST employ an appropriate code or a secure device password for this purpose. Screen locking MUST automatically activate after a short period of inactivity.
CON.7.A6 Prompt Reporting of a Loss [User](B)
Employees MUST report any loss or theft of information, IT systems, or storage media to their organisation immediately. To this end, there MUST be clear reporting channels and contact persons within the organisation. The organisation MUST evaluate the possible impacts of the loss and take appropriate countermeasures.
CON.7.A7 Secure Remote Access to an Organisation's Network [IT Operation Department, User] (B)
In order to allow secure remote access to an organisation’s network for employees on trips abroad, the IT Operation Department MUST set up secure remote access (e.g. via a virtual private network, VPN) in advance. VPN access MUST be cryptographically secured. In addition, users MUST have sufficiently secure access data to successfully authenticate themselves on their end devices and their organisation's network. Employees MUST use secure remote access for all communications which are possible in this context. Care MUST be taken to ensure that only authorised persons can access IT systems which have remote access. To the greatest extent possible, mobile IT systems MUST be protected against direct access to the Internet by a restrictively configured personal firewall.
CON.7.A8 Secure Use of Public WLANs [User] (B)
Whether or not mobile IT systems are allowed direct access to the Internet MUST always be specified. To access an organisation's network via publicly accessible WLANs, the user MUST use a VPN or comparable security mechanisms (see CON.7.A7 Secure Remote Access and NET.2.2 WLAN Usage). Security safeguards MUST also be taken when using WLAN hotspots (see also INF.9 Mobile Workplace).
CON.7.A9 Secure Handling of Mobile Storage Media [User] (B)
If mobile storage media are used, users MUST ensure in advance that they are not infected with malware. Before passing on mobile storage media, users MUST also ensure that they do not contain any sensitive information. If a storage medium is no longer used, it MUST be securely deleted, especially if it is to be passed on to other persons. To this end, the storage medium MUST be overwritten using a sufficiently secure method specified by the organisation in question.
CON.8 Software Development R3 Information domain/generic aspects
Target Object: Information domain/generic aspects / Order: R3
CON.8.A1 Definition of Roles and Responsibilities [Central Administration] (S)
One person SHOULD be appointed to be responsible for the software development process. In addition, the roles and responsibilities for all software development activities SHOULD be defined. The roles SHOULD cover the following topics: • Compliance management and change management • Software design and architecture • Information security in software development • Software implementation in the areas relevant to the development project at hand • Software testing One person SHOULD be appointed to be responsible for information security for each development project.
CON.8.A10 Source Code Version Management [Developer] (B)
Development project source code MUST be managed by an appropriate version management system. An organisation MUST regulate access to its version management system and define when changes made to source code by Developers is to be stored as a separate version in the system. It MUST be ensured that all changes to source code can be tracked and reversed by means of the version management system. Version management MUST be included in the organisation's backup concept. Version management MUST NOT take place without data backups.