Information Security Assessment ISA4.txt

01.1 	Release of an Information Security Management System (ISMS)
01.2 	IS Risk Management
01.3 	Effectiveness of the ISMS
05.1 	Information Security Policy
06.1 	Assigning responsibility for information security
06.2 	Information Security in projects
06.3 	Mobile devices
06.3.a (new)	Teleworking
06.4 	Roles and responsibilities for external IT service providers
07.1 	"Contractual information security obligation
of employees"
07.1.a (new)	Qualification of employee(s)
07.2 	Awareness and training of employees
08.1 	Inventory of assets
08.2 	Classification of information
08.3 	Storage of information on mobile data storage devices
08.4 	Removal of externally stored information assets
09.1 	Access to networks and network services
09.2 	User registration
09.2.a (new)	Handling of identification means
09.3 	Privileged user accounts
09.4 	Confidentiality of authentication data
09.5 	Access to information and applications
09.6 	Separation of information in shared environments
10.1 	Encryption
11.1 	Security zones
11.2 	Protection against external influences and external threats
11.3 	Protective measures in the delivery and shipping area
11.4 	Use of equipment
12.1 	Change Management
12.2 	Separation of development, testing and operational environments
12.3 	Protection against malware
12.4 	Backup procedures
12.5 	Event logging
12.6 	Logging administration activities
12.7 	Tracing of vulnerabilities (patch management)
12.8 	Review of information systems
12.9 	Consideration of critical administrative functions of cloud services
13.1 	Management of networks
13.2 	Security requirements for networks/services
13.3 	Separation of networks (network segmentation)
13.4 	Electronic exchange of information
13.5 	Non-disclosure agreements for information exchange with third parties
14.1 	Requirements for the acquisition of information systems
14.2 	Security in the software development process
14.3 	Management of test data
14.4 	Approval of external IT services
15.1 	Risk management in collaboration with suppliers
15.2 	Review of service provision by suppliers
16.1 	Reporting system for information security incidents (incident management)
16.2 	Processing of information security incidents
17.1 	Information Security Aspects of Business Continuity Management (BCM)
18.1 	Legal and contractual provisions
18.2 	Confidentiality and protection of personally identifiable data
18.3 	Audit of the ISMS by independent bodies
18.4 	Effectiveness check