chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
INF.6.A2 Site Access Regulations and Control [Building Services] (B)
A storage media archive MUST ONLY be accessible to authorised persons. Site access MUST be reduced to a minimum number of employees. Therefore, site access MUST be regulated and controlled. A concept MUST be developed for site access control. The effectiveness of the site access control safeguards it contains SHOULD be regularly reviewed to check whether they are still effective. To prevent site access control from being bypassed or at least make this more difficult, the entire room MUST have mechanical resistance safeguards that satisfy the protection needs at hand; under no circumstances should they correspond to less than RC2 (in accordance with DIN EN 1627).
INF.6.A3 Protection Against Dust and Other Contamination (B)
It MUST be ensured that the media in a storage media archive are adequately protected against dust and dirt. The requirements for this MUST be analysed in the planning phase. A strict smoking ban MUST be observed in storage media archives.
INF.6.A4 Closed Windows and Locked Doors [Employee] (B)
A storage media archive SHOULD NOT have windows if they can be avoided. If there are windows, they MUST be closed when leaving the storage media archive. The door MUST also be locked when leaving the room. Fire and smoke doors MUST be closed.
INF.6.A5 Using Protective Cabinets [Employee] (S)
The storage media and other media in storage media archives SHOULD be stored in suitable protective cabinets.
INF.6.A6 Avoidance of Water Pipes [Building Services] (S)
In storage media archives, unnecessary water-bearing pipes SHOULD generally be avoided. If water pipes are nevertheless laid through a storage media archive, they SHOULD be checked regularly to ensure that they are still watertight. In addition, precautions SHOULD be taken so that any water leaks will be detected at an early stage. For a storage media archive with high availability requirements, there SHOULD be response plans that specify exactly who is to be informed in case of a leak and how to proceed in general.
INF.6.A7 Compliance with Climatic Requirements [Building Services] (S)
It SHOULD be ensured that the maximum and minimum values permitted for temperature and humidity, as well as the dust content of the air in the room, are observed in a storage media archive. The air temperature and humidity values SHOULD be recorded and documented several times a year for a period of one week. Any detected deviations from the target value SHOULD be corrected promptly. The air conditioning system used SHOULD be serviced regularly.
INF.6.A8 Secure Doors and Windows [Planner] (S)
Security safeguards such as windows, doors, and walls SHOULD be appropriate and up to the task of dealing with burglary, fire, and smoke. Depending on the protection needs at hand, a suitable resistance class SHOULD be implemented in accordance with DIN EN 1627. All security doors and windows SHOULD be checked regularly to ensure that they are still functioning properly. The entire storage media archive in question SHOULD have mechanical resistance safeguards that meet the relevant protection needs and correspond to RC3 (according to DIN EN 1627) at minimum.
INF.6.A9 Alarm System [Building Services] (H)
An appropriate alarm system SHOULD be set up in storage media archives. This alarm system SHOULD be inspected and serviced regularly. It SHOULD be ensured that the recipients of alarm messages are able to react appropriately to them.
INF.7 Office Workplace
Target Object: Building/room / Order: R2
INF.7.A1 Suitable Selection and Use of an Office Room [Supervisor] (B)
Rooms used as offices MUST be suitable for this purpose. Office rooms MUST be selected and equipped in accordance with the protection needs or protection level of the information processed in such rooms. Office rooms that are open to the public MUST NOT be located in security-sensitive areas. Germany's regulation on workplaces (Arbeitsstättenverordnung) MUST be implemented for workplaces and the equipment of office rooms.
INF.7.A2 Closed Windows and Locked Doors [Employee, Building Services] (B)
When employees leave their office rooms, all windows SHOULD be closed. If confidential information is located in an office room, the doors MUST be locked when leaving the room. This SHOULD be observed in particular in areas used by the public. The corresponding specifications SHOULD be included in suitable instructions. All employees SHOULD be required to comply with the instructions. In addition, regular checks MUST be carried out to ensure that the windows are closed when leaving an office room and, if necessary, that the doors are locked. Furthermore, it MUST be ensured that fire doors and smoke control doors are actually closed.
INF.7.A3 Exposed Cables (S)
The power connections and network access points in an office room SHOULD be located in the same places as the IT devices used. Cabling routed over the floor SHOULD be covered by a cable duct.
INF.7.A5 Workplace Ergonomics [Central Administration, Supervisor] (S)
All employees SHOULD have ergonomic workplaces. Above all, the monitors SHOULD be positioned to allow ergonomic and undisturbed working. Here, it SHOULD be ensured that screens are not exposed to unauthorised persons. Germany's occupational protection ordinance for working at screens (Bildschirmarbeitsschutzverordnung, BildscharbV) SHOULD be implemented. All workplaces SHOULD be individually adjustable to ensure problem-free IT operations.
INF.7.A6 Workplace Cleanliness [Employee, Supervisor] (S)
All employees SHOULD be required to keep their workplaces tidy when they leave them. Employees SHOULD make sure that no confidential information can be viewed by unauthorised persons. All employees SHOULD carefully check their workplaces and ensure that no confidential information is freely accessible. Supervisors SHOULD check workplaces sporadically to ensure that no sensitive information is exposed.
INF.7.A7 Suitable Storage of Official Documents and Storage Media [Employee, Building Services] (S)
Employees SHOULD be instructed to lock up confidential documents and storage media when they are not in use. To this end, suitable containers SHOULD be provided in or near office rooms.
INF.7.A8 Use of Anti-Theft Devices [Employee] (H)
If access to rooms cannot be limited in a suitable manner, anti-theft protection devices SHOULD be used for all IT systems. Anti-theft protection devices SHOULD also be used in areas frequented by the public.
INF.8 Working from Home
Target Object: Building/room / Order: R2
INF.8.A1 Securing Official Documents at the Home Workplace (B)
Official documents and storage media MUST be stored at a home workplace in such a way that they are inaccessible to unauthorised persons. Therefore, sufficient lockable containers (e.g. wheeled containers or cabinets) MUST be available. Every employee MUST leave their home workplace in a tidy condition and ensure that no sensitive information is freely accessible.
INF.8.A2 Transporting Working Material to the Home Workplace (B)
The storage media and documents that may be processed at a home workplace and transported between it and the respective organisation MUST be specified. In general, storage media and other documents MUST be transported securely. These rules MUST be communicated to all employees in a suitable manner.
INF.8.A3 Protection Against Unauthorised Access to the Home Workplace (B)
Employees MUST be informed of the rules and safeguards to be considered with regard to anti-burglary and site access protection. For example, they MUST be instructed to close windows and lock doors when leaving their home workplace. It MUST be ensured that unauthorised persons cannot enter a home workplace or access work-related IT or documents at any time. These safeguards MUST be reviewed at appropriate intervals, or at least when domestic circumstances change.
INF.8.A4 Suitable Configuration of the Home Workplace (S)
A home workplace SHOULD be separated from the private areas of the home based on a suitable room layout. A home workplace SHOULD have office furniture that meets ergonomic requirements. A home workplace SHOULD also be protected against burglary by suitable technical security safeguards. The security safeguards SHOULD be adapted to the local situation and the protection needs at hand.
INF.8.A5 Disposal of Confidential Information at the Home Workplace (S)
Confidential information SHOULD be disposed of securely. A special security policy SHOULD thus specify how to dispose of sensitive material. The required disposal options SHOULD be available.
INF.8.A6 Handling Official Documents with Increased Protection Needs at the Home Workplace (H)
If employees must process work-related documents or information with increased protection needs, it SHOULD be considered whether working from home is feasible at all. Otherwise, the home workplaces in question SHOULD be protected by extended high-quality technical safeguards.
INF.9 Mobile Workplace
Target Object: Information domain/generic aspects / Order: R2
INF.9.A1 Appropriate Selection and Usage of a Mobile Workplace [IT Operation Department] (B)
An organisation MUST stipulate how employees are to select and use mobile workplaces in a suitable way. It MUST define the features that are desirable for a mobile workplace. It MUST also define the criteria that rule out a mobile workplace. At minimum, the following MUST be specified: • Workplace conditions that are allowed for processing sensitive information • How employees at mobile workplaces should protect their information against unwanted third-party access • Whether a continuous network and power supply is required • Workplace environments that are absolutely forbidden
INF.9.A10 Use of Anti-Theft Devices [Employee] (H)
If an IT system in use provides a means of anti-theft protection, this SHOULD be used. Anti-theft devices SHOULD always be used in places with increased public traffic or a high rate of user fluctuation. In this respect, employees SHOULD always take into account that the protection of the information stored on an IT system usually has a higher value than the cost of the system itself. The acquisition and usage criteria for anti-theft devices SHOULD be adapted to an organisation’s processes and documented.
INF.9.A11 Prohibiting Use of Insecure Environments [IT Operation Department] (H)
The minimum criteria that mobile working environments must fulfil to allow the processing of information with increased protection needs SHOULD be determined. The criteria should cover the following topics at minimum: • Access and viewing by third parties • Closed and, if required, lockable or guarded rooms • Secured communication options • A sufficient power supply
INF.9.A12 Using a Screen Protector [Employee] (S)
When IT systems are used at mobile workplaces, employees SHOULD use privacy screens.
INF.9.A2 Regulations for Mobile Workplaces [Human Resources Department] (B)
For all work done on the move, the information that may be transported and processed outside the organisation at hand MUST be regulated, along with the protective safeguards to be taken. The framework conditions required in order for employees with mobile IT systems to access their organisation's internal information MUST also be defined. There MUST be clear rules governing the transportation of IT components and storage media. These MUST specify the IT systems and storage media that are allowed to be transported, the persons authorised to transport them, and the basic security requirements to be considered. Records MUST be kept as to who has used which mobile devices at what times while not on their organisation's premises. The users of mobile devices MUST be made aware of the value of mobile IT systems and the information stored on them. They MUST be informed of the specific threats and safeguards regarding the IT systems they use. Moreover, they MUST be informed of the types of information that may be processed on mobile IT systems. All users MUST be informed of the rules they need to follow. They MUST be trained accordingly.
INF.9.A3 Site and Data Access Protection [Central Administration, Employee] (B)
Employees MUST be informed of the rules and safeguards to be considered with regard to intrusion and site access protection at mobile workplaces. When a mobile workplace is not in use, the windows and doors MUST be closed. If this is not possible, such as on a train, employees MUST store all their documents and IT systems in a secure location when they are absent or take them with them. It MUST be ensured that unauthorised persons cannot access work-related IT or documents at any time. If a workplace is only left for a short time, the IT systems in use MUST be locked so that they can only be used again after successful authentication.
INF.9.A4 Working with External IT Systems [IT Operation Department, Employee] (B)
An organisation MUST specify how employees may work with external IT systems. Every mobile employee MUST be informed about the dangers of third-party IT systems. The regulations MUST specify whether and how sensitive information may be processed on third-party IT systems. They MUST also specify how to prevent unauthorised persons from viewing such information. If employees work with external IT systems, it MUST be ensured in principle that all temporary data created during such periods is deleted.
INF.9.A5 Prompt Reporting of a Loss [Employee] (S)
Employees SHOULD report any loss or theft of information, IT systems, or storage media to their organisation immediately. To this end, there SHOULD be clear reporting channels and contact persons within the organisation.
INF.9.A6 Disposal of Confidential Information [Employee] (S)
Confidential information SHOULD be disposed of securely, even on the move. Before old or defective storage media and documents are destroyed, they MUST be checked for sensitive information. If they contain sensitive information, storage media and documents MUST be returned and disposed of or destroyed using the respective organisation’s methods.
INF.9.A7 Legal Framework Conditions for Mobile Working [Human Resources Department] (S)
Framework conditions pertaining to labour regulations and occupational safety laws SHOULD be observed and specified for mobile working. All the relevant aspects SHOULD be clarified in employment agreements, or in separate agreements between mobile employees and their employers as a supplement to their employment contracts.
INF.9.A8 Security Policy for Mobile Workplaces [IT Operation Department] (S)
All the relevant security requirements for mobile workplaces SHOULD be documented in a security policy that is mandatory for mobile employees. Furthermore, this policy SHOULD be adapted to the existing security policies of the organisation in question and agreed with all its relevant departments. The security policy for mobile workplaces SHOULD be updated regularly. The employees of the organisation SHOULD be made aware of and trained in its current security policy.
INF.9.A9 Encryption of Portable IT Systems and Storage Media [IT Operation Department] (S)
It SHOULD be ensured that portable IT systems and storage media are secured in line with the respective organisation's internal guidelines. Mobile IT systems and storage media SHOULD be encrypted. Cryptographic keys SHOULD be stored separately from the corresponding encrypted devices.
ISMS.1 Security Management
Target Object: Information domain/generic aspects / Order: R1
ISMS.1.A1 Acceptance of Overall Responsibility for Information Security by Top Management [Top Management] (B)
An organisation''s Top Management MUST take overall responsibility for information security in the organisation. This MUST be clear to everyone involved. The Top Management MUST initiate, control, and monitor the security process. The Top Management MUST set a good example regarding information security.
The Top Management MUST define the responsibilities for information security. The responsible employees MUST be equipped with the necessary skills and resources.
The Top Management MUST be regularly informed about the organisation''s information security status. In particular, the Top Management MUST be informed about possible risks and consequences due to a lack of security safeguards.
ISMS.1.A10 Drawing Up a Security Concept (S)
For the specified scope (the information domain), an adequate security concept SHOULD be drawn up as the central document in the security process. It SHOULD also be decided whether the security concept can also consist of several sub-concepts that are drawn up successively to establish the required level of security in selected areas first. In the security concept, specific security safeguards appropriate for the information domain under consideration MUST be derived from the security objectives of the organisation in question, the protection needs identified, and the risk evaluation conducted. The security process and the security concept MUST take the individually applicable regulations and provisions into account. The safeguards provided in the security concept MUST be implemented promptly in practice. Their implementation MUST be planned and monitored.
ISMS.1.A11 Continuity of Information Security (S)
An organisation SHOULD review its security process, security concepts, information security policy, and organisational structure for information security in terms of their appropriateness and effectiveness and update them at regular intervals. Completeness and update checks of the security concept SHOULD also be performed regularly in this regard. Security audits SHOULD be performed regularly. In this regard, there SHOULD be rules that specify which areas and security safeguards need to be checked when and by whom. The level of security SHOULD be reviewed regularly (at least once a year) and whenever there is a reason to do so. These reviews SHOULD be performed by qualified and independent persons. The results of the reviews SHOULD be documented in a transparent manner. Based on this, shortcomings SHOULD be eliminated and corrective measures taken.
ISMS.1.A12 Management Reports on Information Security [Top Management] (S)
An organisation's Top Management SHOULD be regularly informed about the status of information security—in particular, about the current threat landscape and the effectiveness and efficiency of its security process. In addition, management reports SHOULD be written that contain the most important information relevant to the security process, especially with regard to problems, successes, and potential improvements. The management reports SHOULD contain clearly prioritised proposals for action. The proposed actions SHOULD be accompanied by realistic estimates of the expected implementation effort. The management reports SHOULD be archived in an audit-compliant manner. Management decisions relating to required actions, the handling of residual risks, and changes to security-relevant processes SHOULD be documented. These management decisions SHOULD be archived in an audit-compliant manner.
ISMS.1.A13 Documentation of the Security Process (S)
The security process SHOULD be documented. Important decisions and the work results of the individual phases, such as the security concept, policies, or findings resulting from examinations of security incidents, SHOULD be documented adequately. A procedure SHOULD be defined for the creation and archiving of documentation within the framework of the security process. Rules SHOULD be in place to ensure that documentation is kept up to date and confidential. The respective current versions of existing documents SHOULD be available on short notice. Furthermore, all previous versions SHOULD be archived centrally.
ISMS.1.A15 Cost-Effective Use of Resources for Information Security (S)
An organisation's security strategy SHOULD take economic aspects into account. If security safeguards are defined, the resources required for them SHOULD be quantified. The resources planned for information security SHOULD be provided on time. Additional internal employees or external experts SHOULD be called in for workload peaks or special tasks.
ISMS.1.A16 ISMS.1.A16 Creating Target-Group-Orientated Security Policies (H)
In addition to general security policies, there SHOULD be target-group-oriented security policies that cover the relevant security topics as needed.
ISMS.1.A17 Taking Out Insurance (H)
It SHOULD be examined whether insurance can be taken out against residual risks. An organisation's existing insurance policies SHOULD be checked regularly to ensure they are still appropriate for the current situation.
ISMS.1.A2 Defining Security Objectives and Strategy [Top Management] (B)
An organisation''s Top Management MUST initiate and establish the security process. For this purpose, the Top Management MUST define and document appropriate security objectives and an information security strategy. Conceptual specifications MUST be developed and organisational framework conditions established to enable the proper and secure handling of information within all the organisation''s business processes or specialised tasks.
The Top Management MUST support and take responsibility for its organisation''s security strategy and security objectives. The Top Management MUST regularly review these security objectives and the security strategy to ensure that they are still relevant and appropriate and can be implemented effectively.
ISMS.1.A3 Drawing Up an Information Security Policy [Top Management] (B)
An organisation''s Top Management MUST adopt an overarching information security policy. 
This MUST describe the value of information security, the organisation''s security objectives, the most important elements of the security strategy, and the organisational structure for information security. The scope of the security policy MUST be clearly defined. The policy for information security MUST explain the security objectives and how they relate to the business objectives and tasks of the organisation.
The Top Management MUST communicate the information security policy to all staff and other members of the organisation. The information security policy SHOULD be updated regularly.
ISMS.1.A4 Appointment of a Chief Information Security Officer [Top Management] (B)
An organisation''s Top Management MUST appoint a Chief Information Security Officer (CISO). 
The CISO MUST promote information security in the organisation and help steer and coordinate the security process.
The Top Management MUST provide the CISO with adequate resources. The Top Management MUST allow the CISO to report directly to it when required.
The CISO MUST be involved at an early stage in all larger projects and in the introduction of new applications and IT systems.
ISMS.1.A5 Contract Design When Appointing an External Chief Information Security Officer [Top Management] (B)
An organisation's Top Management MUST appoint an external Chief Information Security Officer (CISO) if the role of CISO cannot be filled by an internal employee. The contract with the external CISO MUST include all the tasks of the CISO and their related rights and obligations. The contract MUST include an appropriate confidentiality agreement. The contract MUST ensure that the corresponding relationship is terminated in an orderly fashion, including with regard to the handover of tasks back to the organisation in question.