chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
DER.2.3.A6 Returning to Production Operations (B)
After the affected network has been cleaned successfully, the IT systems MUST be returned to production operations in a controlled manner. In so doing, all the previously used IT systems and installed programs that were used to observe and analyse the attack MUST either be removed or incorporated into the productive environment. The same MUST be done with communication and collaboration systems procured for the purpose of cleaning. Evidence and decommissioned IT systems MUST either be deleted or destroyed securely, or archived appropriately.
DER.2.3.A7 Targeted System Hardening (S)
After an APT attack, all the IT systems affected SHOULD be hardened. This SHOULD be based on the results of forensic examinations. In addition, there SHOULD be a further check on whether the affected environment is still secure. If possible, IT systems SHOULD already be hardened as they are being cleaned. Safeguards that cannot be performed on short notice SHOULD be added to an action plan and implemented in the medium term. The CISO SHOULD draw up the plan and check that it has been implemented properly.
DER.2.3.A8 Establishing Secure, Independent Communication Channels (S)
Secure communication channels SHOULD be established for the management committee in question and the employees charged with cleaning. If third-party communication services are used, care SHOULD be taken to ensure that a secure communication channel is selected.
DER.2.3.A9 Hardware Replacement in Affected IT Systems (H)
Whether hardware needs to be replaced completely after an APT incident SHOULD be considered. If suspicious behaviour is still observed after cleaning the individual IT systems affected, the respective systems SHOULD be replaced.
DER.3.1 Audits and Revisions
Target Object: Information domain/generic aspects / Order: R3
DER.3.1.A1 Definition of Responsibilities [Top Management] (B)
An organisation’s Top Management MUST appoint an employee who will be responsible for planning and initiating audits and revisions. The Top Management MUST ensure that there is no conflict of interests in this appointment. The organisation MUST use audits and revisions to improve its security safeguards.
DER.3.1.A10 Creation of a Audit Plan or Revision Plan [Audit Team] (S)
Prior to an audit or a major revision, the head of the Audit Team or the lead revisor SHOULD create an audit plan or revision plan. For audits, the audit plan SHOULD be part of the final audit report. The audit plan SHOULD be updated throughout the audit and adjusted as required. Minor revisions SHOULD be scheduled according to the revision list. The respective organisation SHOULD provide sufficient resources to the Audit Team or revision team.
DER.3.1.A11 Communication and Behaviour During Audits [Audit Team] (S)
The Audit Team SHOULD set clear rules for the exchange of information between the Audit Team or revision team and the employees of the organisation or department to be audited. The Audit Team SHOULD use suitable safeguards to ensure that the information shared in an audit remains confidential and its integrity remains intact. Persons supporting the audit SHOULD NOT influence its activities. Furthermore, they SHOULD be obliged to maintain confidentiality.
DER.3.1.A12 Holding an Initial Meeting [Audit Team] (S)
The Audit Team or revision team SHOULD hold an initial meeting with the relevant contact persons. The audit or revision procedure SHOULD be explained and the framework conditions of the on-site audit agreed. The respective persons in charge SHOULD confirm this.
DER.3.1.A13 Inspection and Review of Documents [Audit Team] (S)
The documents SHOULD be checked by the Audit Team based on the requirements defined in the Gap Analysis Plan. All the relevant documents SHOULD be reviewed as to whether they are up to date, complete, and comprehensible. The results of the document check SHOULD be documented. To the extent that doing so makes sense, the results SHOULD also be incorporated into the on-site audit.
DER.3.1.A14 Selection of Samples [Audit Team] (S)
The Audit Team SHOULD select the samples for the on-site audit in a risk-oriented manner and justify them in a comprehensible way. The selected samples SHOULD be documented. If the audit is being performed based on the target objects and requirements of an IT-Grundschutz module, these SHOULD be selected on the basis of a previously defined method. When selecting samples, the results of previous audits SHOULD be taken into consideration, as well.
DER.3.1.A15 Selection of Appropriate Audit Techniques [Audit Team] (S)
The Audit Team SHOULD implement suitable methods for each of the areas to be audited. Furthermore, it SHOULD be ensured that all audits are proportionate to the situation at hand.
DER.3.1.A16 Schedule of the On-Site Audit [Audit Team] (S)
The Audit Team SHOULD set the schedule of the on-site audit together with the contact person in question. The results SHOULD be documented in the audit plan
DER.3.1.A17 Performance of the On-Site Audit [Audit Team] (S)
At the beginning of an on-site audit, the Audit Team SHOULD hold an initial meeting with the persons in charge at the organisation concerned. Afterwards, all the requirements specified in the Gap Analysis Plan SHOULD be checked using the audit methods defined. If a selected sample deviates from the documented status, the sample SHOULD be extended as needed until the issue is clarified. The Audit Team SHOULD conduct a closing meeting after the audit. It SHOULD briefly present the results (without assessments) and explain the steps ahead. The meeting SHOULD be documented in writing.
DER.3.1.A18 Conducting Interviews [Audit Team] (S)
The Audit Team SHOULD conduct structured interviews. Questions SHOULD be concise, precise, and easy to understand. In addition, appropriate interviewing techniques SHOULD be used.
DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)
The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk. The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.
DER.3.1.A2 Preparing an Audit or Revision (B)
Prior to an audit or revision, an organisation MUST define the audit object and its corresponding goals. The affected contact partners MUST be informed. Depending on the object of the audit or revision, the employee responsible MUST inform the Employee Representatives of the planned audit or revision.
DER.3.1.A20 Holding a Closing Meeting [Audit Team] (S)
The Audit Team SHOULD conduct a closing meeting with the respective persons in charge at the audited organisation. This SHOULD present the preliminary audit findings and lay out the next steps.
DER.3.1.A21 Analysis of Audits [Audit Team] (S)
After an on-site audit, the Audit Team should further consolidate and evaluate the information gained. After any additional information and documentation requested after the fact are analysed, the audited safeguards SHOULD be subjected to a final evaluation. The Audit Team SHOULD allow the organisation in question a sufficient time frame for providing the requested documentation. Documents not received by the agreed date SHOULD be considered non-existent.
DER.3.1.A22 Creation of an Audit Report [Audit Team] (S)
The Audit Team SHOULD transfer the results obtained into an audit report and document them transparently. The organisation audited SHOULD ensure that all the entities affected are provided with the sections of the audit report that are important and necessary for them within an appropriate time frame.
DER.3.1.A23 Documentation of Revision Results (S)
The results of a revision SHOULD be documented uniformly by the revision team.
DER.3.1.A24 Conclusion of the Audit or Revision [Audit Team] (S)
After the audit or revision, all the relevant documents, data storage media, and IT systems SHOULD be returned or destroyed. This SHOULD be coordinated with the audited organisation. In doing so, storage obligations resulting from legal or other binding requirements SHOULD be taken into account accordingly. Furthermore, the CISO SHOULD have all the forms of access granted to the Audit Team or revision team disabled or deleted. There SHOULD be an agreement with the auditors or revisors as to how the results are to be handled. This SHOULD also establish that the audit results must not be forwarded to other organisations without the consent of the audited organisation.
DER.3.1.A25 Evaluation of an Audit (S)
The audited organisation SHOULD eliminate the deviations or shortcomings identified in the audit report or within the framework of a revision within a reasonable period of time. The corrective measures to be taken SHOULD be documented, along with the corresponding deadlines and the persons responsible. Corrective measures that have been completed already SHOULD also be documented. The organisation SHOULD establish and use a defined procedure for this purpose. In the event of serious deviations or shortcomings, the Audit Team or revision team SHOULD check whether the corrective measures have been carried out.
DER.3.1.A26 Monitoring and Adapting the Audit Program (S)
The audit program followed SHOULD be monitored and adapted continuously to ensure compliance with regard to dates, audit objectives, audit contents, and audit quality. The appropriateness of the audit program SHOULD be checked based on the requirements it is meant to fulfil and the results of the audits performed. It SHOULD be adapted as necessary
DER.3.1.A27 Storage and Archiving of Documents on Audits and Revisions (S)
The organisation in question SHOULD file and store audit programs and documents on audits and revisions in a traceable and audit-proof manner in accordance with regulatory requirements. This SHOULD ensure that only authorised persons can access audit programs and documents. The organisation SHOULD securely destroy the audit programs and documents after the retention period has expired.
DER.3.1.A3 Conducting an Audit [Audit Team] (B)
During an audit, the Audit Team MUST check whether the requirements of guidelines, norms, standards, and other relevant specifications are being fulfilled. The organisation being audited MUST be aware of these requirements. The Audit Team MUST carry out a document check and an on-site audit during each audit process. During the on-site audit, the Audit Team MUST ensure that it never actively interferes with systems itself and does not issue instructions regarding changes to the audit object. The Audit Team MUST document all the results of the audit in writing and summarise them in an audit report. The audit report MUST be submitted to the contact person of the organisation in a timely manner.
DER.3.1.A4 Performing a Revision (B)
Within the framework of a revision, the Audit Team MUST check that the current requirements are being met in a complete, correct, and appropriate manner. The organisation in question MUST correct any deviations found as quickly as possible. The respective revisions MUST be documented in a revision history.
DER.3.1.A5 Integration into the Information Security Process (S)
An organisation SHOULD provide a policy for internal ISMS auditing. It SHOULD also establish a policy on the management of corrective action. These policies SHOULD specify that regular audits and revisions are part of the security process and initiated by said process. Furthermore, the CISO SHOULD ensure that the results of audits and revisions are returned to the ISMS and incorporated into its improvement. The CISO SHOULD include the audits and revisions carried out and their results in their regular report to the organisation's Top Management. This SHOULD also detail the deficiencies eliminated and the quality improvements made.
DER.3.1.A6 Definition of an Audit and Revision Basis and a Uniform Evaluation Scheme (S)
An organisation SHOULD establish a uniform basis for audits. A uniform evaluation scheme SHOULD be defined and documented for evaluating the implementation of requirements.
DER.3.1.A7 Drawing Up an Audit Program (S)
The CISO SHOULD draw up an audit program that contains all the audits and revisions to be performed in the next several years. Objectives SHOULD be defined for the audit program that are derived in particular from the information security goals at hand and the aims of the corresponding organisation. The CISO SHOULD provide for contingency reserves in the organisation's annual resource planning. The audit program SHOULD be subject to its own continuous improvement process.
DER.3.1.A8 Creation of a Revision List (S)
The CISO SHOULD maintain one or more revision lists that document the current status of the revision objects and the scheduled revisions.
DER.3.1.A9 Selection of an Appropriate Audit Team or Revision Team (S)
An organisation SHOULD assemble a suitable team for every audit and revision. It SHOULD appoint a leading auditor (Audit Team Leader) or a leading revisor. This person SHOULD take complete responsibility for carrying out the audits or revisions. The size of the Audit Team or revision team SHOULD correspond to the area to be audited. In particular, the organisation SHOULD consider the competencies required for the subjects of an audit and the size and local distribution of the area to be audited. The members of the audit or revision team SHOULD be appropriately qualified. The neutrality of the Audit Team SHOULD be guaranteed. The revisors SHOULD also be independent. If external service providers are deployed as auditors or revisors, their independence SHOULD be checked and they SHOULD be obliged to maintain confidentiality.
DER.3.2 Audits Based on the BSI Guideline for IS Audits”
Target Object: Information domain/generic aspects / Order: R3
DER.3.2.A1 Designation of Persons in Charge of the IS Audit [Top Management] (B)
An organisation MUST designate a person in charge of IS auditing. This person MUST plan and initiate IS audits and track their results.
DER.3.2.A10 Communication Coordination (S)
There SHOULD be clear rules on how information is to be exchanged between the IS Audit Team and the organisation to be audited. This SHOULD ensure that the confidentiality and integrity of this information remains intact.
DER.3.2.A11 Holding an Initial Meeting for an IS Cross-Cutting Audit [IS Audit Team] (S)
When an IS cross-cutting audit is to be conducted, an initial meeting SHOULD take place between the IS Audit Team and the contact persons within the organisation to be audited. The meeting SHOULD include the following items: • Explanation and presentation of the IS audit process • Presentation of the organisation to be audited (focus of work and overview of the IT used) • Handover of the reference documents to the IS Audit Team
DER.3.2.A12 Creation of a Gap Analysis Plan [IS Audit Team] (S)
Prior to an IS audit, the IS Audit Team SHOULD create a Gap Analysis Plan. If it is necessary to extend or otherwise adapt the planned procedures during the audit, the Gap Analysis Plan SHOULD be adapted accordingly. The Gap Analysis Plan SHOULD also be included in the final IS audit report. During an IS partial audit, the binding audit subject list from BSI SHOULD be used as the Gap Analysis Plan.
DER.3.2.A13 Inspection and Review of Documents [IS Audit Team] (S)
The IS Audit Team SHOULD check the requirements defined in the Gap Analysis Plan during its document check. The IS Audit Team SHOULD check whether all the relevant documents are up to date and complete. When checking whether documents are up to date, their granularity SHOULD be taken into consideration. Care SHOULD be taken to ensure that all the relevant aspects are included and appropriate roles are assigned. Furthermore, the transparency of the documents and the decisions they contain SHOULD be checked. To the extent that doing so makes sense, the results of the document review SHOULD be documented and incorporated into the on-site audit.
DER.3.2.A14 Selection of Target Objects and Requirements to Be Audited [IS Audit Team] (S)
Within the framework of an IS cross-sectional audit or an IS partial audit, the IS Audit Team SHOULD select the module target objects for the on-site audit based on the results of the checks of documents. However, the information security management module (see ISMS.1 Security Management)) of the IT-Grundschutz Compendium, including all its related requirements, SHOULD always be checked completely. A further 30 per cent of the remaining module target objects SHOULD be selected for auditing in a risk-based approach. The selection SHOULD be documented in a transparent manner. For the module target objects selected in this way, 30 per cent of the respective requirements SHOULD be checked during the IS audit. In addition, the requirements for which shortcomings have been found in previous IS audits SHOULD be taken into account when selecting the module target objects to be audited. All requirements for which serious security shortcomings have been ascertained in previous IS audits SHOULD be audited.
DER.3.2.A15 Selection of Appropriate Audit Techniques [IS Audit Team] (S)
The IS Audit Team SHOULD ensure that appropriate audit techniques are used to determine the areas to be audited. All audits SHOULD be proportionate.
DER.3.2.A16 Creating a Procedure for the On-Site Audit [IS Audit Team] (S)
Together with the contact person of the organisation to be audited, the IS Audit Team SHOULD draw up a schedule for the on-site audit. The results SHOULD be documented along with the IS Gap Analysis Plan.
DER.3.2.A17 Conducting the On-Site Audit [IS Audit Team] (S)
The IS Audit Team SHOULD investigate and determine whether the selected measures for the on-site audit meet the requirements of IT-Grundschutz in a practical and adequate manner. The audit SHOULD start with an initial meeting. All the requirements of the Gap Analysis Plan that are selected for the audit and/or all the subject areas from the audit subject list SHOULD then be checked. The envisaged audit techniques SHOULD be used for this purpose. If deviations from the documented status of a selected sample are identified, the sample SHOULD be extended as required until the matter is clarified. During the on-site audit, the IS auditors SHOULD never actively interfere with IT systems or issue any instructions regarding changes to the object of the audit. All essential issues and details on source, information, and presentation requests, as well as meetings carried out, SHOULD be documented in writing. In a closing meeting, the IS Audit Team SHOULD briefly present the main findings to the contact persons of the audited organisation. The IS Audit Team SHOULD NOT specifically evaluate the findings, but provide indications of possible deficiencies and explain the next steps. Minutes SHOULD also be taken for this closing meeting.
DER.3.2.A18 Conducting Interviews [IS Audit Team] (S)
Interviews conducted by the IS Audit Team SHOULD be structured. Questions SHOULD be concise, precise, and easy to understand. In addition, appropriate interviewing techniques SHOULD be used.
DER.3.2.A19 Reviewing Risk Treatment Options [IS Audit Team] (S)
The IS Audit Team SHOULD check whether the remaining residual risks are appropriate and acceptable for the information domain at hand and whether the Top Management has officially acknowledged its acceptance of them in a binding manner. The IS Audit Team SHOULD randomly verify whether and to what extent the options selected to treat risks have been implemented.
DER.3.2.A2 Creation of an IS Audit Manual (B)
The person in charge of an IS audit MUST create an IS audit manual that contains the objectives, legal requirements, and information about the organisation, its resources, and the framework conditions at hand. It MUST also describe how to archive the related documentation. The manual MUST be approved by the Top Management.
DER.3.2.A20 Following Up on the On-Site Audit [IS Audit Team] (S)
After the on-site audit, the information collected by the IS Audit Team SHOULD be further consolidated and analysed. After any additional information and documentation requested after the fact have been assessed, the audited requirements SHOULD be subject to a final evaluation.
DER.3.2.A21 Creation of an IS Audit Report [IS Audit Team] (S)
The IS Audit Team SHOULD transfer the results obtained into an IS audit report and document them transparently. A draft version of the report SHOULD be sent in advance to the audited organisation. It SHOULD be verified whether the issues established by the IS Audit Team were correctly recorded. The audited organisation SHOULD ensure that all affected entities within the organisation are provided with the sections of the IS audit report that are important and necessary for them within an appropriate time frame. In particular, the contents SHOULD be communicated to the Top Management, the person in charge of the IS audit, and the CISO. IS audit reports SHOULD be assigned an appropriate confidentiality rating based on the sensitive information they contain. The possibility of having the IS Audit Team provide the results of the IS audit to the Top Management in the form of a presentation SHOULD be considered.
DER.3.2.A22 Following Up on an IS Audit (S)
The deviations identified in the IS audit report SHOULD be corrected by the CISO within a reasonable period of time. The corrective measures to be performed SHOULD be documented along with the respective responsibilities, dates of implementation, and status. The implementation SHOULD be followed up on continuously and the implementation status updated. The necessity of additional IS audits SHOULD be checked as a matter of principle. The person in charge of the IS audit SHOULD adapt both the rough and detailed plans for the IS audit.
DER.3.2.A3 Definition of the Audit Basis (B)
An IS audit MUST be carried out based on BSI Standards 200-1 to 200-3 and the IT-Grundschutz Compendium. The IT-Grundschutz Standard Protection SHOULD be used for this. These audit principles MUST be known to all the parties involved.
DER.3.2.A4 Drawing Up a Plan for the IS Audit (B)
If an organisation is not certified in line with ISO 27001 on the basis of IT-Grundschutz, the person in charge of its IS audit and the organisation's Top Management MUST ensure that an IS partial audit or IS cross-cutting audit is carried out at least every three years. In addition, further audits should be planned if the information domain in question is significantly changed. The person in charge of the IS audit should draw up a rough multi-year plan for audits. This schedule SHOULD then be made more specific in a detailed one-year schedule.
DER.3.2.A5 Selection of an Appropriate IS Audit Team (B)
A team consisting of at least two IS auditors MUST be assembled or commissioned. The IS Audit Team MUST be granted unlimited information and inspection rights for its activities. In internal IS Audit Teams, the individual IS auditors MUST be impartial. The members of an IS Audit Team MUST NOT be or have been involved in planning or implementing the ISMS in question.
DER.3.2.A6 Preparation of an IS Audit [IS Audit Team] (B)
An IS Audit Team MUST be commissioned to conduct an IS audit. The IS Audit Team MUST determine the reference documents required for the IS audit. The organisation to be audited MUST hand over its security concept and all other necessary documents to the IS Audit Team.
DER.3.2.A7 Performance of an IS Audit [IS Audit Team] (B)
Within the framework of an IS audit, the IS Audit Team MUST perform a document audit and an on-site audit. All the results of the two audits MUST be documented in writing and summarised in an IS audit report. Before performing an IS cross-cutting audit for the first time, the person in charge of the IS audit MUST select an IS partial audit as the IS audit procedure. The IS partial audit MUST be completed with a positive result before an IS cross-cutting audit is performed.