InfoSecRequirements.txt

"+ The requirements for information security have been determined and documented.
  - The requirements are adapted to the goals of the organization.
  - A policy has been created and approved by the organization's management.
+ The policy includes objectives and the significance of information security within the organization."

"+ The scope of the ISMS (the organization managed by the ISMS) is defined.
+ The organization's requirements for the ISMS are determined.
+ The organizational management has commissioned and approved the ISMS.
+ The ISMS provides the organizational management with suitable monitoring and control means (e.g. management review).
+ Applicable controls have been identified (e.g. ISO 27001 Statement of Applicability, completed ISA Questionary).
+ The effectiveness of the ISMS is regularly reviewed by the management."
"+ Responsibilities for information security within the organization are defined, documented and assigned.
+ The responsible employees are defined and qualified for their task.
+ The required resources are available.
+ The contact persons are known within the organization and to relevant business partners."
+ Projects are classified considering their information security requirements.
"+ The concerned services and IT services used are identified.
+ The security requirements relevant to the IT service are determined:
+ The organization responsible for implementing each individual requirement is defined and aware of its responsibility.
+ Mechanisms for shared responsibilities are specified and implemented.
+ The responsible organization fulfils its respective responsibilities."

"i'+ nformation assets of critical value to the organization are identified and recorded.
  - A person responsible for these information assets is assigned.
+ The supporting assets processing the information assets are identified and recorded.
  - A person responsible for these supporting assets is assigned."
"+ A consistent scheme for the classification of information assets with regard to the protection objective of confidentiality is available.
+ Evaluation of the identified information assets is carried out according to the defined criteria and assigned to the existing classification scheme.
+ Requirements for the handling of supporting assets (e.g. marking, correct handling, transport, storage, return, deletion/disposal) depending on the classification of the information assets exist and are applied."
"+ External IT services are not used without explicit evaluation and implementation of the information security requirements
  - A risk assessment of the external IT services exists
  - Legal, regulatory and contractual requirements are taken into account
+ The external IT services are aligned with the protection needs of the information assets to be processed"

"+ Risk assessments are carried out both at regular intervals and in response to events.
+ Information security risks are assessed in a suitable manner according to e.g. probability of occurrence and potential damage.
+ Information security risks are documented.
+ A responsible person (risk owner) is assigned to each information security risk. This person is responsible for the assessment and handling of the information security risks."

"+ Observation of policies is verified throughout the organization.
+ Information security policies and procedures are reviewed at regular intervals.
+ Measures for correcting potential non-conformities (deviations) are initiated and pursued.
+ Compliance with information security requirements (e.g. technical specifications) is verified at regular intervals.
+ The results of the conducted reviews are recorded and retained."
"+ Information security reviews are carried out by an independent and competent body at regular intervals and in case of significant changes.
+ Measures for correcting potential deviations are initiated and tracked."

"+ A definition of information security events/vulnerabilities exists.
+ A procedure for reporting and recording information security events/vulnerabilities is defined and implemented.
+ The following aspects are considered:
  - Reaction to information security events/vulnerabilities
  - Reporting form and reporting channel
  - processing station
  - feedback procedure
  - references to technical and organisational measures (e.g. disciplinary measures).
+ Procedures for ensuring traceability in case of information security events/vulnerabilities are established and documented.
+ Information security events/vulnerabilities are assessed and documented in order to ensure traceability.
+ An adequate reaction to information security events/vulnerabilities is given.
+ A strategy for an adequate reaction to events of information security violations exists.
  - This includes escalation procedures, remedial actions and communication to relevant internal and external bodies as well as a procedure for deciding whether a cybercriminal attack will be legally prosecuted. "

"+ Sensitive work fields and positions are identified.
+ The requirements for employees regarding their job profile are determined and fulfilled.
+ The identity of potential employees is verified (e.g. checking identity documents)."
"+ A non-disclosure obligation is in effect.
+ An obligation to comply with the information security policies is in effect."
+ Employees are trained and made aware.
"+ The requirements for teleworking are determined and fulfilled. The following aspects are considered:
  - Secure handling of and access to information (both electronically and physically) while taking into account the protection needs and any contractual requirements in private (e.g. home office) and public areas (e.g. when travelling)
  - Conduct in private areas
  - Conduct in public areas
  - Protective measures against theft (e.g. in public areas)
+ Access to the organization’s network is gained via a secure connection (e.g. VPN) and strong authentication."

"+ A security zone concept including the associated protective measures based on the requirements for handling information assets is defined and documented.
+ Security zones are specified and documented under consideration of terrains/buildings/rooms. This also includes delivery and shipping areas.
+ The defined protective measures are implemented.
+ The code of conduct for security zones is known to all persons affected."
"+ Possible exceptional situations are identified and recorded.
+ Potentially endangered infrastructure components (e.g. access points, IT systems) are identified and recorded.
+ Measures for limiting the impact of threats are identified and implemented.
+ For exceptional situations, information security aspects are taken into consideration in methods, processes and procedures."
+ The requirements for handling supporting assets (e.g. transport, storage, repair, loss, return, disposal) are determined and fulfilled.
"+ The requirements for mobile IT devices and mobile data storage devices are determined and fulfilled. The following aspects are considered:
  - Encryption
  - Access protection (e.g. PIN, password)
  - Labelling (taking into account requirements regarding e.g. use within customer sites)"


"+ The requirements for the handling of identification means over the entire lifecycle are determined and fulfilled. The following aspects are considered:
  - Creation, transfer, return and destruction
  - Validity periods
  - Handling of loss"
"+ The procedures for user authentication have been selected based on a risk assessment. Potential attack scenarios have been considered (e.g. direct access via the internet)
+ The procedures used for user authentication are according to the state of the art."
"+ The creation, modification and deletion (lifecycle) of user accounts is performed.
+ Unique and personalized user accounts are used.
+ The use of “collective accounts” is regulated (e.g. restricted to cases where traceability of actions is dispensable).
+ User accounts are disabled immediately after the user has resigned from or left the organization (e.g. upon termination of the employment contract).
+ User accounts are regularly reviewed.
+ The login information is provided to the user in a secure manner.
+ A policy for handling login information is defined and implemented. The following aspects are considered:
  - No disclosure of login information to third parties – not even persons of authority – under consideration of legal restrictions
  - no writing down or unencrypted storing of login information
  - immediate changing of login information whenever potential compromise is suspected
  - no use of identical login information for business and non-business purposes
  - changing of temporary or initial login information following the 1st login
 - requirements for the quality of login information (e.g. length of password, types of characters to be used).
+ The login information (e.g. passwords) of a personalized user account must be known to the assigned user only. "

"+ The requirements for the management of access rights (authorization) are determined and fulfilled. The following aspects are considered:
  - Procedures for application, verification and approval
  - Application of the “need-to-know” principle
+ Access rights granted to normal and privileged user accounts and technical accounts, including those in customer IT systems, are reviewed at regular intervals."


"+ All cryptographic procedures used (e.g. encryption, signature, and hash algorithms, protocols, applications) provide the security required by the respective application according to the state of the art.
+ The legal parameters for the use of cryptography are taken into account."
"+ The network services used to transfer information are identified and documented.
+ Policies and procedures in accordance with the classification requirements for the use of network services are defined and implemented.
+ Measures for the protection of transferred contents against unauthorized access are implemented."

+ Information security requirements for changes to the organization, business processes, IT systems are determined and applied.
"+ The IT systems have been subjected to risk assessment in order to determine the necessity of their separation into development and productive systems.
+ A separation is implemented based on the results of risk analysis."
"+ Requirements for protection against malware are identified.
+ Technical and organizational measures for protection against malware are defined and implemented."
"+ Information security requirements regarding the handling of event logs are determined and fulfilled.
+ Security-relevant requirements regarding the logging of activities of system administrators and users are determined and fulfilled.
+ The IT systems used are assessed regarding the necessity of logging.
+ Where externally operated services (particularly cloud services) are used, information on monitoring options are obtained and considered in the evaluation.
+ Event logs are checked regularly for rule violations and noticeable problems in compliance with the permissible legal and organizational provisions.
+ Procedures for handling rule violations are specified (e.g. reporting to authorized bodies). "
"+ Information on technical vulnerabilities for the IT systems in use is gathered (e.g. information from the manufacturer, system audits, CVS database) and evaluated (e.g. Common Vulnerability Scoring System CVSS)
+ Potentially affected IT systems and software are identified, assessed and any vulnerabilities are addressed."
"+ Requirements for auditing of IT systems are determined.
+ The scope of the system audit is specified in a timely manner.
+ System audits are coordinated with the operator and users of the IT systems.
+ The results of system audits are stored in a traceable manner and reported to the relevant management.
+ Measures are derived from the results."
"+ Requirements for the management and control of networks are determined and fulfilled.
+ Requirements regarding network segmentation are determined and fulfilled."

"+ The information security requirements associated with the design and development of IT systems are determined and taken into account.
+ The information security requirements associated with the acquisition or extension of IT systems and IT components are determined and taken into account.
+ Information security requirements associated with changes to IT systems are taken into account.
+ System approval tests are carried out under consideration of the information security requirements."
+ Requirements regarding the information security of network services are determined and fulfilled.
+ A procedure for returning and securely removing information assets from any external IT service is defined and implemented.
+ Effective segregation (e.g. segregation of tenants) prevents access to own information by unauthorized users of other organizations.

"+ Suppliers and cooperation partners are subjected to a risk assessment with regard to information security.
+ An appropriate level of information security is ensured by contractual agreements with suppliers and cooperation partners.
+ Where applicable, contractual agreements with customers are passed on to suppliers and cooperation partners.
+ Compliance with contractual agreements is verified."
"+ The non-disclosure requirements are determined and fulfilled.
+ Requirements and procedures for applying non-disclosure agreements are known to all persons passing on information in need of protection.
+ Valid non-disclosure agreements are concluded prior to  forwarding sensitive information.
+ The requirements and procedures for applying non-disclosure agreements and handling sensitive information are regularly reviewed."

"+ Legal, regulatory and contractual requirements and specifications of relevance to information security (see examples) are regularly determined.
+ Policies regarding compliance with the requirements are defined, implemented and communicated to the responsible persons."
"+ Legal and contractual information security requirements regarding the procedures and processes in the processing of personal data are determined.
+ Regulations regarding the compliance with legal and contractual requirements for the protection of personal data are defined and known to the entrusted persons.
+ Processes and procedures for the protection of personal data are taken into account in the information security management system."