## 5 BSI Secure Networking Guide
### Content Completeness and Depth of the BSI Guide
The two subcategories _IPv6 Specification_ and _Address Features_ are ranked as the highest for importance within this category and are covered well. IPsec and ICMPv6:This category received the lowest weighting of all categories and also achieves the lowest completeness value for the BSI guide. Out of 69 relevant RFCs only 14 are covered which results in 0.20 (20%) completeness. This is because the BSI guide is completely ignoring _Cryptographic Methods_ and _IKEv2_. It also ignores IPsec to a large extent, only mentioning it as a side note. Without these three subcategories, the completeness would be above 50%. Still, there are also many RFCs missing in the other subcategories, except for _Path MTU Discovery_ which only consists of one RFC. Completeness for the category is 0.11. Again this would be higher without the before mentioned categories. _Neighbor Discovery_ only got a completeness of 0.29, which could be seen as negative but is a good result when taking into account that six out of eleven RFCs are not even covered. IPsec, as one of the most important topics, is barely covered. Its depth is also very low at 0.08. This shows that even the covered RFCs have not much detail. In general, completeness and depth of this category are very low and should be increased. At least IPsec should be given more room and explanation. DHCPv6 and Autoconfiguration:The smallest of the five categories involves only 14 relevant RFCs. The BSI guide, however, only covers 4 of them. This results in a completeness of 0.29 or 29%. There are only two subcategories. _Stateless Autoconfiguration_ has two RFCs, which are both covered in the BSI guide. The second subcategory _DHCPv6_, with the bigger part of 12 RFCs, is only represented with two of them, resulting in a completeness of 0.17, and thus lowering the completeness of the whole category. This also has an effect on depth. The main category only got a depth score of 0.16. While _Stateless Autoconfiguration_ has a medium grade of 0.6, _DHCPv6_ is as low as 0.08 which, basically, means this topic is barely mentioned. At least the main RFC about DHCPv6 is covered with a depth of medium (0.6). When looking at the importance rating, _Stateless Autoconfiguration_ is well aligned, _DHCPv6_ needs more coverage because an importance rating of 6.28 does not align with such a low depth and completeness. Routing and DNS:The category with the highest weighting _Routing and DNS_ is not well covered in the BSI guide. Only 10 out of 40 relevant RFCs are presented. This results in a completeness of 0.25 (25%). Except for the subcategory _Routing Protocols_ that has all of its relevant RFCs at least mentioned and briefly explained (5 out of 5), all other subcategories have at most a completeness of 0.33. _DNSSEC_ is not even mentioned at all, _Multihoming_ is barely addressed and even _Security Issues_ regarding DNSreceive almost no coverage (1 out of 9). Depth of the category is only 0.11 which is due to the many missing RFCs. Generally, only one of the three RFCs (RFC 3596--DNS extension for IPv6) received a high score for depth (0.8). Only because of this, the depth of the DNS Specification achieved 0.27, which is still less than \"low\". The other subcategories have even lower depth scores. _Security issues_ should be covered more profoundly since its importance rating is the highest of the category. A depth of only 0.04 on this topic is not acceptable for a secure deployment guide. _Routing Protocols_ are well represented and depth is aligned with their importance. The same holds for Protocol Independent Multicast (_PIM_), which has the lowest importance rating of all subcategories and thus does not need to receive more attention. _DNSSEC_ and _Multihoming_ clearly are not dealed with sufficiently. While their importance rating is not the highest, giving a note about their existence or possible issues seems necessary. In general, this category is underrepresented in the BSI guide, given its high importance as shown by the results of the survey. More focus has to be put on _Security Issues_.