Safeguards which have been assigned a priority 1 should be implemented first. With some safeguards a time sequence is suggested naturally by the logical inter-relationship of the measures concerned. Thus, for example, safeguards S 2.25 Documentation of the System Configuration and S 2.26 Appointment of an Administrator and his Deputy are both important, but without an Administrator it is not practical to implement S 2.25. Many of the safeguards have a significant effect in broad areas, whereas others have only a limited, local effect. Often it is advisable to start with the safeguards which have a broad effect.
Some modules have a bigger impact on the aspired-to security level than others.
Safeguards contained in such modules should be given preference, especially where their implementation will result in the elimination of weaknesses in areas having a high protection requirement. Modules in respect of which there is a particularly large number of missing safeguards represent areas in which security is particularly weak. Preference should likewise be given to these. Once the sequence in which the safeguards will be implemented has been determined, it is then necessary to specify who is responsible for implementing which safeguards and by when. Unless this is done, experience indicates that implementation of safeguards tends to be delayed and in some cases never takes place.