The threats here are divided into the aforementioned categories of Force Majeure, Organisational Shortcomings, Human Error, Technical Failure and Deliberate Acts. To make it easier to see which modules are relevant and to avoid redundancies, in each case only a reference is provided to the text in which the threat is described in more detail. This is followed by the name of the threat. It is recommended that the user then reads the text of the threat referenced for the sake of gaining awareness and understanding the safeguards which apply, but it is not absolutely essential to read this text in order to be able to draw up an IT security concept on the basis of the IT Baseline Protection Manual. The recommended safeguards which are listed after the section on the threat scenario constitute the major part of a given module.
Brief information is presented first of all on the safeguard package concerned.
In some modules these statements contain, for example, information on the recommended sequence to follow in implementing the necessary safeguards. The same procedure is followed as in the handling of threats, i.e. in each case only a reference is provided to the relevant safeguard. The number y after the decimal point is the serial number of the safeguard within the relevant catalogue. This is extremely important when drawing up a plan for the implementation of safeguards which have not previously been implemented or have only partially been implemented. If these would mean that full implementation of all the necessary safeguards would have to be delayed, then the starting point in determining the sequence to be followed in implementing any missing safeguards should be the priority assigned to each of the various safeguards in the modules.