Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00
commit c8e6f30a27
720 changed files with 140143 additions and 0 deletions
@@ -0,0 +1,71 @@
+# Incident Response and Reporting Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-01) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.6.1-M1, 1.6.1-M2, 1.6.2-M1, 1.6.2-M2, 1.6.2-S1, 1.6.2-S2, A.5.24-1, A.5.25-1, A.5.26-1, A.5.27-1, A.5.28-1, A.6.8-1 | POLICY R04 -->
+
+## 1. Purpose
+
+This procedure governs the reporting, assessment, handling and follow-up of information security incidents. It operationalises the associated policy ({{LINK:R04}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Reporting of a security event (employees, technology/monitoring, external parties) via the defined reporting path.
+
+## 4. Inputs
+
+- Report/alert with a brief description
+- Affected systems/information (asset inventory)
+- Classification/protection need
+
+## 5. Process
+
+1. Report the event: record the report via {{TOOL_TICKET}} or email to {{ROLE_ISB}}.
+2. Triage & classification: determine relevance, severity and category.
+3. Containment: initiate immediate measures to limit the damage.
+4. Remediation & recovery: eliminate the cause, restore normal operations.
+5. Check reporting obligations: customers/OEM, authorities, and for personal data {{ROLE_DPO}} (72-hour deadline).
+6. Documentation & lessons learned: close the incident, derive improvement measures.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Report the event | Reporting person | {{ROLE_ISB}} | - | - |
+| 2 | Triage & classification | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 3 | Containment | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} |
+| 4 | Remediation & recovery | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 5 | Check reporting obligations | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | {{ROLE_DPO}} | - |
+| 6 | Documentation & lessons learned | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | {{ROLE_MANAGEMENT}} |
+
+## 7. Result & evidence
+
+Documented, closed incident in {{TOOL_TICKET}}; derived measures in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Time to detect/acknowledge
+- Time to resolve
+- Share of reports made on time
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R04}}
+- {{LINK:VA-02}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,72 @@
+# IT Emergency and Recovery Procedure (BCM)
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-02) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.6.3-M1, 1.6.3-S1, 5.2.8-M1, 5.2.8-S1, A.5.29-1, A.5.30-1, A.8.14-1 | POLICY R04 -->
+
+## 1. Purpose
+
+This procedure governs the maintenance and recovery of critical IT services in the event of failure or crisis. It operationalises the associated policy ({{LINK:R04}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Failure of critical IT services, emergency or crisis (escalation from VA-01).
+
+## 4. Inputs
+
+- List of critical IT services with RTO/RPO
+- Recovery plans
+- Backup status (VA-05)
+
+## 5. Process
+
+1. Identify & classify the emergency: assess the extent, convene the crisis team if necessary.
+2. Activate communication: inform internal/external stakeholders.
+3. Prioritise recovery: order services according to RTO/RPO.
+4. Perform recovery: restore systems/data from backup (VA-05).
+5. Confirm & document the return to normal operations.
+6. Follow-up & test update: update the plan, exercise {{BACKUP_TEST_FREQ}}.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Identify & classify the emergency | {{ROLE_IT_LEAD}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 2 | Activate communication | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | - | Employees |
+| 3 | Prioritise recovery | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 4 | Perform recovery | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 5 | Confirm return to normal operations & | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | {{ROLE_MANAGEMENT}} |
+| 6 | Follow-up & test update | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Recovered services; documented emergency/test in the ISMS tool ({{TOOL_NAME}}); updated recovery plans. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Adherence to RTO/RPO
+- Success rate of recovery tests
+- Up-to-dateness of the emergency plans
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R04}}
+- {{LINK:VA-01}}
+- {{LINK:VA-05}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,71 @@
+# Authorisation Procedure (Joiner/Mover/Leaver and Recertification)
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-03) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 4.1.1-S1, 4.1.3-M1, 4.2.1-M1, 4.2.1-M2, 4.2.1-S1, A.5.15-1, A.5.16-1, A.5.17-1, A.5.18-1, A.8.18-1, A.8.2-1, A.8.3-1, A.8.5-1 | POLICY R08 -->
+
+## 1. Purpose
+
+This procedure governs the request, approval, modification, revocation and regular review of access rights. It operationalises the associated policy ({{LINK:R08}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Joining, role change or leaving of a person; authorisation request; due recertification.
+
+## 4. Inputs
+
+- HR notification
+- Role/rights catalogue (RBAC)
+- Existing authorisations from the central directory ({{TOOL_IAM}})
+
+## 5. Process
+
+1. Record the request: request access/right in {{TOOL_TICKET}} (joiner/mover).
+2. Business approval: check the necessity according to the least-privilege principle and approve.
+3. Implementation: set rights on a role basis in the central directory ({{TOOL_IAM}}).
+4. Leaver/change: upon leaving/change, revoke/adjust rights without delay.
+5. Recertification ({{RECERT_FREQ}}, BL-IAM-05): owners confirm/revoke rights.
+6. Privileged accounts: review and log separately (BL-IAM-06).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Record the request | Manager/business unit | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Business approval | Business unit/data owner | Business unit/data owner | {{ROLE_ISB}} | - |
+| 3 | Implementation | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | Requester |
+| 4 | Leaver/change | {{ROLE_IT_LEAD}} | {{ROLE_HR_LEAD}} | - | - |
+| 5 | Recertification ({{RECERT_FREQ}}, BL-IAM-05) | Business unit/data owner | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 6 | Privileged accounts | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Documented requests/approvals in {{TOOL_TICKET}}; current authorisation status in the central directory ({{TOOL_IAM}}); recertification evidence. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of leaver rights revoked on time
+- Recertification rate
+- Number of orphaned/privileged accounts
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R08}}
+- {{LINK:VA-01}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,71 @@
+# Change and Patch Management Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-04) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.2.1-M1, 5.2.5-M1, A.7.13-1, A.8.19-1, A.8.32-1, A.8.9-1 | POLICY R10 -->
+
+## 1. Purpose
+
+This procedure governs planned changes to IT systems as well as the risk-oriented installation of patches. It operationalises the associated policy ({{LINK:R10}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Need for change, available patch or identified vulnerability (VA-06).
+
+## 4. Inputs
+
+- Change/patch request
+- Risk assessment
+- Patch SLA (BL-OPS-01)
+
+## 5. Process
+
+1. Request & classify the change (standard/normal/emergency) in {{TOOL_TICKET}}.
+2. Risk/impact assessment incl. rollback plan.
+3. Approval by CAB/responsible role.
+4. Test in a separate environment (BL-OPS, R10).
+5. Implementation in production in accordance with the patch SLA (critical {{PATCH_SLA_CRIT}}).
+6. Verification & documentation of the result in {{TOOL_TICKET}}.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Request & classify the change | Requester | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Risk/impact assessment incl. rollback | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 3 | Approval by CAB/responsible role | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 4 | Test in a separate environment | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 5 | Implementation in production per patch SLA | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | Affected parties |
+| 6 | Verification & documentation of the result | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Documented, approved and verified change/patch in {{TOOL_TICKET}}. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Patch compliance per criticality
+- Share of successful changes (without rollback)
+- Lead time of critical patches
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R10}}
+- {{LINK:VA-06}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Backup and Restore Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-05) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.2.9-M1, 5.2.9-M2, 5.2.9-S1, A.8.13-1 | POLICY R10 -->
+
+## 1. Purpose
+
+This procedure governs data backup, retention and recovery according to the {{BACKUP_SCHEME}} scheme. It operationalises the associated policy ({{LINK:R10}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Regular backup run; recovery need; scheduled restore test.
+
+## 4. Inputs
+
+- Backup plan per system
+- Classification/RPO
+- Backup targets ({{TECH_BACKUP}})
+
+## 5. Process
+
+1. Perform backup: automated backups in accordance with {{BACKUP_SCHEME}} (BL-OPS-05).
+2. Monitoring: check success/failure, track failed runs ({{TOOL_TICKET}}).
+3. Protection & offsite storage: 1 copy offline/immutable, retention {{BACKUP_RETENTION}}.
+4. Process restore request (on demand/emergency, VA-02).
+5. Perform & document recovery test ({{BACKUP_TEST_FREQ}}, BL-OPS-06).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Perform backup | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Monitoring | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 3 | Protection & offsite storage | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 4 | Process restore request (on demand) | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | Requester | - |
+| 5 | Recovery test ({{BACKUP_TEST_FREQ}}) | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Logged backups; documented restore tests; evidence in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Backup success rate
+- Success rate of restore tests
+- Adherence to RPO
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R10}}
+- {{LINK:VA-02}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Vulnerability Management Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-06) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.2.5-M1, 5.2.5-S1, 5.2.6-M1, A.8.8-1 | POLICY R10 -->
+
+## 1. Purpose
+
+This procedure governs the detection, assessment, treatment and technical review of vulnerabilities. It operationalises the associated policy ({{LINK:R10}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Regular scan ({{VULN_SCAN_FREQ}}), security advisory/CVE, penetration test ({{PENTEST_FREQ}}).
+
+## 4. Inputs
+
+- Scan/test reports
+- Asset inventory & criticality
+- Patch SLA (BL-OPS-01)
+
+## 5. Process
+
+1. Identification: evaluate vulnerability scan {{VULN_SCAN_FREQ}} (BL-OPS-02) and advisories.
+2. Assessment & prioritisation according to criticality and exposure.
+3. Initiate treatment: patch/change (VA-04) or compensating measure.
+4. Technical review: hardening (BL-OPS-07) and penetration tests ({{PENTEST_FREQ}}, BL-OPS-08).
+5. Tracking & verification of the remediation in {{TOOL_TICKET}}.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Identification | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Assessment & prioritisation by criticality | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 3 | Initiate treatment | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 4 | Technical review | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | External service provider | - |
+| 5 | Tracking & verification of the remediation | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Tracked vulnerabilities with treatment status in {{TOOL_TICKET}}; test reports. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Mean time to remediate per criticality
+- Open critical vulnerabilities
+- Scan coverage
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R10}}
+- {{LINK:VA-04}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Cryptography Concept and Key Management
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-07) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.1.1-M1, 5.1.1-M2, 5.1.1-S1, 5.1.2-M1, 5.1.2-S1, A.8.24-1 | POLICY R09 -->
+
+## 1. Purpose
+
+This procedure governs the use of cryptographic procedures and the management of keys throughout the lifecycle. It operationalises the associated policy ({{LINK:R09}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+New need for encryption/certificates; key renewal/revocation; change in the state of the art.
+
+## 4. Inputs
+
+- Permissible algorithms (BL-CRY-02)
+- Protection need of the data
+- Certificate/key inventory
+
+## 5. Process
+
+1. Determine need & procedure: select permissible algorithms {{CRYPTO_ALGO}} (BL-CRY-02).
+2. Generate keys/certificates and distribute them securely (BL-CRY-05).
+3. Storage & access protection (separate storage, {{#if FLAG_CRYPTO_PKI}}PKI, {{/if}}authorisations).
+4. Ensure transmission protection: at least {{TLS_MIN}} (BL-CRY-01).
+5. Document renewal/revocation/destruction.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Determine need & procedure | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 2 | Generate keys/certificates and distribute securely | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 3 | Storage & access protection (separate storage) | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 4 | Ensure transmission protection | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 5 | Document renewal/revocation/destruction | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Documented cryptography concept; traceable key/certificate lifecycle. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of compliant procedures/algorithms
+- Expiring certificates without renewal
+- Coverage of transport encryption
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R09}}
+- {{LINK:VA-04}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Asset and Classification Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-08) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.3.1-M1, 1.3.1-M2, 1.3.1-S1, 1.3.2-M1, 1.3.2-M2, 1.3.2-S1, A.5.10-1, A.5.11-1, A.5.12-1, A.5.13-1, A.5.9-1, A.7.10-1, A.7.14-1, A.8.10-1 | POLICY R02 -->
+
+## 1. Purpose
+
+This procedure governs the recording, owner assignment, classification and maintenance of information assets and assets. It operationalises the associated policy ({{LINK:R02}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+New/changed asset; procurement; regular inventory review.
+
+## 4. Inputs
+
+- Procurement/change notification
+- Classification scheme
+- Asset inventory ({{TOOL_NAME}})
+
+## 5. Process
+
+1. Record the asset in the inventory ({{TOOL_NAME}}) with attributes.
+2. Assign an owner.
+3. Classify (confidentiality/integrity/availability) by the owner.
+4. Apply handling requirements per protection class (labelling/storage/deletion BL-DEL-01).
+5. Maintenance & review ({{REVIEW_CYCLE}}) for up-to-dateness.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Record the asset in the inventory ({{TOOL_NAME}}) | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Assign an owner | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | Asset owner |
+| 3 | Classify (confidentiality/integrity) | Asset owner | Asset owner | {{ROLE_ISB}} | - |
+| 4 | Apply handling requirements per protection class | Asset owner | {{ROLE_ISB}} | - | Employees |
+| 5 | Maintenance & review ({{REVIEW_CYCLE}}) | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Up-to-date, classified asset inventory in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Inventory coverage
+- Share of classified assets
+- Assets without an owner
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R02}}
+- {{LINK:VA-03}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Risk Management Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-09) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.4.1-M1, 1.4.1-M2, 1.4.1-M3, 1.4.1-S1, 6.1.1-1, 6.1.2-1, 6.1.3-1, 8.2-1, 8.3-1 | POLICY R03 -->
+
+## 1. Purpose
+
+This procedure governs the identification, analysis, assessment, treatment and monitoring of information security risks. It operationalises the associated policy ({{LINK:R03}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+New system/project, incident, change, regular review cycle.
+
+## 4. Inputs
+
+- Asset/process list
+- Assessment scales & acceptance thresholds
+- Existing risk register
+
+## 5. Process
+
+1. Identify risks (assets, threats, vulnerabilities).
+2. Analyse & assess (likelihood × impact) in the ISMS tool ({{TOOL_NAME}}).
+3. Determine treatment (reduce/avoid/transfer/accept) and plan measures.
+4. Document residual risk acceptance.
+5. Monitor & update ({{REVIEW_CYCLE}} and on an ad-hoc basis).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Identify risks (assets, threats) | {{ROLE_ISB}} | {{ROLE_ISB}} | Asset/process owners | - |
+| 2 | Analyse & assess (likelihood × impact) | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 3 | Determine treatment (reduce/avoid) | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | Business unit | - |
+| 4 | Document residual risk acceptance | {{ROLE_MANAGEMENT}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 5 | Monitor & update ({{REVIEW_CYCLE}}) | {{ROLE_ISB}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Maintained risk register with treatment plan and acceptance decisions in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of treated risks
+- Overdue measures
+- Up-to-dateness of the risk register
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R03}}
+- {{LINK:VA-01}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Supplier Onboarding and Assessment Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-10) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 6.1.1-M1, 6.1.1-M2, 6.1.1-S1, 6.1.2-M1, 6.1.2-S1, 6.1.3-M1, A.5.19-1, A.5.20-1, A.5.21-1, A.5.22-1 | POLICY R13 -->
+
+## 1. Purpose
+
+This procedure governs the selection, security-related assessment, contractual commitment and monitoring of suppliers/service providers. It operationalises the associated policy ({{LINK:R13}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+New supplier/service provider with access to information; contract renewal; periodic review.
+
+## 4. Inputs
+
+- Service/protection-need description
+- Risk classes (BL-SUP-01)
+- NDA/contract templates
+
+## 5. Process
+
+1. Determine need & risk class (protection need, access).
+2. Carry out security assessment (self-disclosure/evidence/TISAX).
+3. Agree NDA & contractual security requirements.
+4. Delineate responsibilities (operations/security/reporting).
+5. Add to the supplier register ({{TOOL_NAME}}) and review {{REVIEW_CYCLE}}.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Determine need & risk class (protection need, access) | Procurement/business unit | {{ROLE_ISB}} | - | - |
+| 2 | Security assessment (self-disclosure/evidence/TISAX) | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | - |
+| 3 | NDA & contractual security requirements | Procurement | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 4 | Delineate responsibilities (operations/security) | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 5 | Add to the supplier register ({{TOOL_NAME}}) | {{ROLE_ISB}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Assessed, contractually committed supplier in the supplier register ({{TOOL_NAME}}); NDA on file. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of assessed suppliers
+- NDA coverage
+- Overdue supplier reviews
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R13}}
+- {{LINK:VA-11}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Cloud and AI Approval Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-11) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.3.4-M1, 5.3.4-M2, 5.3.4-S1, 5.3.4-KI-M1, 5.3.4-KI-M2, 5.3.4-KI-M3, 5.3.4-KI-S1, A.5.23-1 | POLICY R12 -->
+
+## 1. Purpose
+
+This procedure governs the assessment and approval of cloud and AI/GenAI services as well as their permissible use. It operationalises the associated policy ({{LINK:R12}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Request to use a cloud or AI service.
+
+## 4. Inputs
+
+- Service description & provider information
+- Protection need/data classes
+- Contract/DPA documents
+
+## 5. Process
+
+1. Record the request in {{TOOL_TICKET}} (service, purpose, data classes).
+2. Assessment: protection need, data location/EU, tenant separation, exit; for AI, exclusion of training/passing on.
+3. Review contract/DPA (for AI: opt-out/enterprise contract, EU AI Act).
+4. Approval & inclusion in the approval list ({{TOOL_NAME}}); define permissible data classes.
+5. Use & control: human in the loop for AI, periodic review ({{REVIEW_CYCLE}}).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Record the request in {{TOOL_TICKET}} (service) | Requester/business unit | {{ROLE_ISB}} | - | - |
+| 2 | Assessment | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | {{ROLE_DPO}} |
+| 3 | Review contract/DPA (for AI) | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | {{ROLE_DPO}} | - |
+| 4 | Approval & inclusion in the approval list | {{ROLE_ISB}} | {{ROLE_ISB}} | - | Business unit |
+| 5 | Use & control | Business unit | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Approval decision and approval list in the ISMS tool ({{TOOL_NAME}}); documented permissible data classes. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of approved vs. used services
+- Shadow IT findings
+- Overdue service reviews
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R12}}
+- {{LINK:VA-10}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Awareness and Training Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-12) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 2.1.3-M1, 2.1.3-S1, 7.3-1, A.6.3-1 | POLICY R05 -->
+
+## 1. Purpose
+
+This procedure governs the planning, delivery and evidence of awareness and training on information security. It operationalises the associated policy ({{LINK:R05}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Joining of new employees; annual training cycle; ad-hoc after incidents.
+
+## 4. Inputs
+
+- Training plan/curriculum (BL-HR-01)
+- Target groups/roles
+- Participation status ({{TOOL_NAME}})
+
+## 5. Process
+
+1. Plan training needs & target groups (role-specific).
+2. Deliver onboarding training upon joining.
+3. Deliver regular training ({{REVIEW_CYCLE}}, BL-HR-01).
+4. Check effectiveness (phishing simulation) and provide follow-up training.
+5. Evidence participation in the ISMS tool ({{TOOL_NAME}}).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Plan training needs & target groups (role-specific) | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_HR_LEAD}} | - |
+| 2 | Deliver onboarding training upon joining | {{ROLE_HR_LEAD}} | {{ROLE_ISB}} | - | Employees |
+| 3 | Regular training ({{REVIEW_CYCLE}}, BL-HR-01) | {{ROLE_ISB}} | {{ROLE_ISB}} | - | Employees |
+| 4 | Check effectiveness (phishing simulation) | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 5 | Evidence participation in the ISMS tool ({{TOOL_NAME}}) | {{ROLE_HR_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Documented training participation and effectiveness measurement in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Training completion rate
+- Phishing click rate
+- Share of role-specific training
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R05}}
+- {{LINK:VA-01}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,69 @@
+# Logging and Monitoring Procedure
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-13) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.2.4-M1, 5.2.4-S1, A.8.15-1, A.8.16-1, A.8.17-1 | POLICY R10 -->
+
+## 1. Purpose
+
+This procedure governs the collection, protection, evaluation and retention of security-relevant log data. It operationalises the associated policy ({{LINK:R10}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Continuous operations; security-relevant event; alert from {{TECH_SIEM}}.
+
+## 4. Inputs
+
+- Log sources/systems
+- Retention requirements (BL-OPS-04)
+- Alerting rules
+
+## 5. Process
+
+1. Connect log sources and record centrally in {{TECH_SIEM}} (BL-OPS-04).
+2. Ensure tamper protection & retention {{LOG_RETENTION}}.
+3. Evaluation & alerting: maintain rules, check anomalies.
+4. Hand over suspected cases to incident response (VA-01).
+5. Regular review of coverage and rules.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Connect log sources and record centrally in {{TECH_SIEM}} | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 2 | Tamper protection & retention {{LOG_RETENTION}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 3 | Evaluation & alerting | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 4 | Hand over suspected cases to incident response (VA-01) | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+| 5 | Regular review of coverage and rules | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Central, protected logging with evaluation; evidence in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Log source coverage
+- Mean time to alert response
+- Share of evaluable events
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R10}}
+- {{LINK:VA-01}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,71 @@
+# Personnel Security – Suitability Check & Sensitive Activities
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-14) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_HR_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 2.1.1-M1, 2.1.1-M2, 2.1.1-M3, 2.1.1-S1, 2.1.1-S2, 2.1.2-M1, 2.1.2-M2, 2.1.2-S1, 2.1.2-S2, 2.1.2-S3, A.6.1-1, A.6.2-1, A.6.5-1, A.6.6-1 | POLICY R05 -->
+
+## 1. Purpose
+
+This procedure governs the determination of sensitive activities, the suitability and identity check upon hiring as well as the handling of violations of information security and confidentiality obligations. It operationalises the associated policy ({{LINK:R05}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all hiring, change and leaving processes.
+
+## 3. Trigger
+
+Hiring, change to a sensitive position, suspicion of a violation, regular review.
+
+## 4. Inputs
+
+- Register of sensitive activities ({{LINK:REG-SENS-ROLES}})
+- Job descriptions with security requirements
+- HR notification; legal framework (data protection/co-determination)
+
+## 5. Process
+
+1. Determine sensitive activity areas/roles in the **register of sensitive activities ({{LINK:REG-SENS-ROLES}})** and define the required depth of checking per role.
+2. Record requirements for positions in job descriptions and ensure their fulfilment.
+3. Upon hiring, verify identity; check personal suitability within the legally permissible scope (job interview).
+4. For sensitive roles, carry out extended checks (references, criminal record certificate) within the legally permissible scope.
+5. Handle violations of information security/confidentiality obligations following a documented procedure; evidence in the personnel file.
+6. Review sensitive roles and depth of checking regularly ({{REVIEW_CYCLE}}).
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Determine sensitive activities & depth of checking | {{ROLE_ISB}} | {{ROLE_HR_LEAD}} | Business unit | - |
+| 2 | Requirements in job descriptions | {{ROLE_HR_LEAD}} | {{ROLE_HR_LEAD}} | Business unit | - |
+| 3 | Verify identity / check suitability | {{ROLE_HR_LEAD}} | {{ROLE_HR_LEAD}} | {{ROLE_ISB}} | - |
+| 4 | Extended checks (sensitive roles) | {{ROLE_HR_LEAD}} | {{ROLE_HR_LEAD}} | {{ROLE_ISB}} | - |
+| 5 | Handling of violations | {{ROLE_HR_LEAD}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 6 | Regular review | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_HR_LEAD}} | - |
+
+## 7. Result & evidence
+
+Maintained register of sensitive activities; documented suitability/verification evidence in the personnel file; documented violation cases. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of sensitive roles with documented depth of checking
+- On-time identity/suitability checks
+- Open violation cases
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R05}}
+- Register: {{LINK:REG-SENS-ROLES}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,72 @@
+# Internal Audits & Compliance Reviews
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-15) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_MANAGEMENT}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.5.1-M1, 1.5.1-M2, 1.5.1-M3, 1.5.1-M4, 1.5.1-M5, 1.5.1-S1, 1.5.2-M1, 1.5.2-M2, 1.5.2-S1, 9.2-1, A.5.35-1, A.5.36-1, A.8.34-1 | POLICY R03 -->
+
+## 1. Purpose
+
+This procedure governs the programme, planning, execution, reporting and measure tracking of internal audits as well as the independent review of the ISMS. It operationalises the associated policy ({{LINK:R03}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all policies, procedures and technical requirements within the scope.
+
+## 3. Trigger
+
+Audit cycle (BL-GOV-01), material changes, request by management, prior findings.
+
+## 4. Inputs
+
+- Audit programme register ({{LINK:REG-AUDIT-PLAN}})
+- Controls / statement of applicability (SoA)
+- Previous audit reports & open measures
+
+## 5. Process
+
+1. Plan the **audit programme** in the **register ({{LINK:REG-AUDIT-PLAN}})** (scope, controls reviewed, dates, auditors) — cycle per **BL-GOV-01**.
+2. Conduct the audit **independently** (auditor ≠ person responsible for the area reviewed).
+3. Record findings/deviations and create them as measures in the ISMS tool ({{TOOL_NAME}}).
+4. Report the audit report to {{ROLE_MANAGEMENT}} (input for the management review).
+5. Track measures through to completion.
+6. Independent review/assessment at least per **BL-GOV-01** or after fundamental changes.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Plan the audit programme | {{ROLE_ISB}} | {{ROLE_ISB}} | Business units | - |
+| 2 | Conduct the audit | Auditor (independent) | {{ROLE_ISB}} | Area reviewed | - |
+| 3 | Record findings / create measures | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | - |
+| 4 | Report to management | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | - | {{ROLE_MANAGEMENT}} |
+| 5 | Track measures | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | - |
+| 6 | Independent review | External/independent auditor | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+
+## 7. Result & evidence
+
+Audit reports, documented findings/measures and a maintained audit programme ({{LINK:REG-AUDIT-PLAN}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Audit coverage of the controls
+- Open findings / on-time completion of measures
+- Share of audits completed on time
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R03}}
+- Register: {{LINK:REG-AUDIT-PLAN}}
+- Risk management procedure: {{LINK:VA-09}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,72 @@
+# Secure Procurement, Development & Acceptance
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-16) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 5.3.1-M1, 5.3.1-M2, 5.3.1-M3, 5.3.1-M4, 5.3.1-S1, 5.3.1-S2, 5.3.1-S3, 5.3.1-S4, 5.3.1-S5, 5.3.1-V1, 5.3.2-M1, 5.3.2-S1, 5.3.2-S2, 5.3.2-S3, 5.3.2-H1, A.8.25-1, A.8.26-1, A.8.27-1, A.8.28-1, A.8.29-1, A.8.30-1, A.8.31-1, A.8.33-1, A.8.4-1 | POLICY R11 -->
+
+## 1. Purpose
+
+This procedure ensures that information security requirements are an integral part of the procurement, design, development, extension and modification of IT services and systems (security by design), including acceptance tests and test data handling. It operationalises the associated policy ({{LINK:R11}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for the procurement, in-house/external development and modification of IT services/systems.
+
+## 3. Trigger
+
+Procurement, new/further development or substantial modification of an IT service/system.
+
+## 4. Inputs
+
+- Security/protection-need requirements; applicable ISA controls
+- Test/acceptance concept
+- Where applicable, external services ({{LINK:REG-EXT-SERVICES}})
+
+## 5. Process
+
+1. Specify security requirements (security by design) and take the protection need into account.
+2. Carry out procurement/modification based on the security criteria.{{#if FLAG_EXTERNAL_IT}} External/cloud services are assessed via {{LINK:VA-11}} and maintained in the {{LINK:REG-EXT-SERVICES}}.{{/if}}
+3. Acceptance tests under security aspects before production deployment; approval in {{TOOL_TICKET}} (change coupling {{LINK:VA-04}}).
+4. Avoid or anonymise production data in tests; protect test systems appropriately.
+5. {{#if FLAG_DEV_INHOUSE}} For in-house development, secure coding requirements apply with code reviews and automated security tests (SAST/dependency scan).{{/if}}
+6. {{#if FLAG_VERY_HIGH_PROTECTION}} Where the protection need is very high, an additional independent security review/acceptance is carried out before approval.{{/if}}
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Specify security requirements | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | Business unit | - |
+| 2 | Carry out procurement/modification | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 3 | Security acceptance / approval | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | Business unit | - |
+| 4 | Test data handling | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_DPO}} | - |
+| 5 | Secure coding / security tests | Development | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 6 | Additional review (very high protection need) | Independent auditor | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+
+## 7. Result & evidence
+
+Acceptance records, test reports and approvals (in {{TOOL_TICKET}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of projects with a documented security acceptance
+- Critical security findings before go-live
+- Share of tests without real production data
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R11}}
+- Change procedure: {{LINK:VA-04}}
+- Cloud/AI approval: {{LINK:VA-11}}; register: {{LINK:REG-EXT-SERVICES}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,67 @@
+# Access & Visitor Management (physical)
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-17) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 3.1.1-S1, 3.1.1-S2, 3.1.1-S3, 3.1.1-S4, 3.1.1-S5, A.7.1-1, A.7.11-1, A.7.12-1, A.7.2-1, A.7.3-1, A.7.4-1, A.7.5-1, A.7.6-1, A.7.7-1, A.7.8-1 | POLICY R07 -->
+
+## 1. Purpose
+
+This procedure governs the granting and revocation of physical access rights, visitor management as well as the handling of utilities in security zones. It operationalises the associated policy ({{LINK:R07}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all sites and security zones.
+
+## 3. Trigger
+
+Joining/leaving/role change, visit, change to the zone concept, regular review.
+
+## 4. Inputs
+
+- Zone/security concept ({{LINK:BASELINE}}, BL-PHY-01/02)
+- Personnel/visitor notification
+- Existing access authorisations
+
+## 5. Process
+
+1. Access rights to security zones are requested, approved and revoked via {{TOOL_TICKET}} (least-privilege principle).
+2. Visitors are registered, identified and escorted in areas requiring protection.
+3. Utilities, keys and badges are issued, taken back and documented.
+4. Access authorisations are reviewed regularly ({{REVIEW_CYCLE}}) and adjusted without delay upon leaving/change.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Grant/revoke access rights | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 2 | Register/escort visitors | Reception/business unit | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 3 | Manage utilities/keys | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 4 | Review access authorisations | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+
+## 7. Result & evidence
+
+Up-to-date access authorisations and visitor logs. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Up-to-dateness of the access list
+- Overdue recertifications of access rights
+- Completeness of visitor logs
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R07}}
+- Authorisation procedure (logical analogue): {{LINK:VA-03}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,66 @@
+# Data Protection & Compliance Maintenance
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-18) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_DPO}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 7.1.1-M1, 7.1.1-M2, 7.1.1-S1, 7.1.2-M1, 7.1.2-M2, 7.1.2-M3, A.5.31-1, A.5.32-1, A.5.33-1, A.5.34-1 | POLICY R14 -->
+
+## 1. Purpose
+
+This procedure governs the ongoing maintenance of the legal/compliance register, the record of processing activities (RoPA), deletion periods/deletion concept and the handling of data subject rights. It operationalises the associated policy ({{LINK:R14}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all processing of personal data as well as legal/contractual requirements.
+
+## 3. Trigger
+
+Regular review, new legal/contractual requirement, data subject request, new or changed processing.
+
+## 4. Inputs
+
+- Legal/compliance register (ISMS tool, {{TOOL_NAME}})
+- Record of processing activities (RoPA)
+- Deletion concept ({{LINK:BASELINE}}, BL-DEL-01)
+
+## 5. Process
+
+1. Review and update the legal/compliance register regularly ({{REVIEW_CYCLE}}).
+2. Maintain the record of processing activities (RoPA) in the ISMS tool ({{TOOL_NAME}}).
+3. Implement and monitor deletion periods and the deletion concept (BL-DEL-01).
+4. Handle data subject rights on time; document the processing and the result.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Maintain legal/compliance register | {{ROLE_DPO}} | {{ROLE_ISB}} | Business unit | - |
+| 2 | Maintain RoPA | {{ROLE_DPO}} | {{ROLE_DPO}} | Business unit | - |
+| 3 | Implement/monitor deletion periods | {{ROLE_IT_LEAD}} | {{ROLE_DPO}} | {{ROLE_ISB}} | - |
+| 4 | Handle data subject rights | {{ROLE_DPO}} | {{ROLE_DPO}} | {{ROLE_ISB}} | - |
+
+## 7. Result & evidence
+
+Up-to-date legal/compliance register and RoPA, deletion evidence, documented data subject requests. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Up-to-dateness of the legal/compliance register
+- Data subject requests handled on time
+- Overdue deletions
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R14}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,70 @@
+# Information Security in Projects
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-19) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.2.3-M1, 1.2.3-S1, 1.2.3-S2, 1.2.3-S3, 1.2.3-H1, A.5.8-1 | POLICY R01 -->
+
+## 1. Purpose
+
+This procedure ensures that information security is taken into account in projects from the outset: project classification, risk assessment in an early phase and upon changes, derivation and tracking of measures as well as involvement of the ISO where the protection need is elevated. It operationalises the associated policy ({{LINK:R01}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all projects relating to information, IT systems or business processes.
+
+## 3. Trigger
+
+Project start, substantial project change, project completion.
+
+## 4. Inputs
+
+- Catalogue of criteria for project classification ({{LINK:BASELINE}}, BL-PROJ-01)
+- Project register ({{LINK:REG-PROJECTS}})
+- Risk assessment scale / risk register
+
+## 5. Process
+
+1. At the outset, classify the project with regard to its information security need on the basis of the **documented catalogue of criteria (BL-PROJ-01)**; entry in the **project register ({{LINK:REG-PROJECTS}})**.
+2. Carry out a risk assessment in an early project phase and upon changes (coupling with risk management {{LINK:VA-09}}).
+3. Derive measures and track them as tasks in {{TOOL_TICKET}}.
+4. {{#if FLAG_ELEVATED_PROTECTION}} Where the protection need is elevated, {{ROLE_ISB}} is involved; additional reviews/approvals take place before critical milestones.{{/if}}
+5. Before project completion, review the implementation of the measures and document it in the project register.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Classify the project | Project management | {{ROLE_ISB}} | {{ROLE_ISB}} | - |
+| 2 | Carry out risk assessment | Project management | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 3 | Derive & track measures | Project management | Project management | {{ROLE_ISB}} | - |
+| 4 | ISO involvement (elevated protection need) | {{ROLE_ISB}} | {{ROLE_ISB}} | Project management | {{ROLE_MANAGEMENT}} |
+| 5 | Final review of measures | Project management | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Maintained project register with classification, risk assessment and measure status. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of classified projects
+- Open project security measures
+- Share of projects with ISO involvement where the protection need is elevated
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R01}}
+- Register: {{LINK:REG-PROJECTS}}
+- Risk management procedure: {{LINK:VA-09}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->
@@ -0,0 +1,38 @@
+# Prototype Access and Transport
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-20) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 8.1.1-M1, 8.3.1-M1 | POLICY P01 -->
+
+## 1. Purpose
+
+This procedure operationalises the Prototype Protection policy ({{LINK:P01}}). It governs access to prototype areas as well as the transport and storage of prototypes so that confidentiality and integrity are ensured.
+
+## 2. Scope
+
+The procedure applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) for all persons and areas involved with prototypes.
+
+## 3. Process
+
+### 3.1 Access
+
+- Access to prototype areas only for individually authorised persons; visitors are escorted and logged.
+- Access rights are reviewed regularly and revoked where necessary.
+
+### 3.2 Transport and storage
+
+- Transport in secured, sealed containers with logged handover.
+- Storage in secured zones with access and visual protection; check-in and check-out are documented in a traceable manner.
+
+## 4. Evidence
+
+Access, handover and storage logs are maintained in accordance with the evidence register ({{LINK:NACHWEISREGISTER}}).
@@ -0,0 +1,78 @@
+# Nonconformities & Corrective Actions
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-21) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_MANAGEMENT}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 10.1-1, 10.2-1 | POLICY R03 -->
+
+## 1. Purpose
+
+This procedure governs the recording, root cause analysis, treatment and effectiveness review of nonconformities and the continual improvement of the ISMS derived from them. It elaborates the corresponding policy ({{LINK:R03}}).
+
+> The procedure also carries the requirement to correct and follow up deviations, as required by the compliance review in security operations ({{LINK:VA-15}}) — it therefore applies regardless of which framework the organisation follows.
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) to all nonconformities against policies, procedures, technical requirements as well as legal and contractual obligations.
+
+## 3. Trigger
+
+Audit finding, result of a compliance review, security incident, deviation of a metric from its target value, report from operations or third parties, observation during the management review.
+
+## 4. Inputs
+
+- Audit reports and findings ({{LINK:VA-15}})
+- Incidents and lessons learned ({{LINK:VA-01}})
+- Metrics deviating from their target value ({{LINK:VA-22}})
+- Risk register and risk treatment plan ({{LINK:VA-09}})
+
+## 5. Process
+
+1. **Record:** create the nonconformity in the ISMS tool ({{TOOL_NAME}}) with origin, description and affected area.
+2. **Respond immediately:** decide the correction to control the deviation and how to deal with its consequences.
+3. **Analyse the cause:** determine the cause and evaluate whether similar nonconformities exist or could occur elsewhere.
+4. **Define corrective action:** decide the action with a responsible role and a due date; size it to the cause, not to the symptom.
+5. **Implement and follow up:** track implementation in {{TOOL_NAME}}; delay escalates to {{ROLE_ISB}}.
+6. **Review effectiveness:** after the defined effectiveness interval, verify that the cause has been eliminated; adjust risks, controls and documents where necessary.
+7. **Close:** document and retain the nature of the nonconformity, the actions taken and the result of the effectiveness review.
+
+## 6. RACI
+
+| # | Step | R (execution) | A (accountable) | C (consulted) | I (informed) |
+|---|------|---------------|-----------------|---------------|--------------|
+| 1 | Record | Reporting person / auditor | {{ROLE_ISB}} | - | - |
+| 2 | Respond immediately | Business unit | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 3 | Analyse the cause | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | - |
+| 4 | Define corrective action | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | Business unit | - |
+| 5 | Implement and follow up | Action owner | {{ROLE_ISB}} | - | {{ROLE_MANAGEMENT}} |
+| 6 | Review effectiveness | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | {{ROLE_MANAGEMENT}} |
+| 7 | Close | {{ROLE_ISB}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Action register with root cause analysis, due dates and documented effectiveness review in {{TOOL_NAME}}. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Number of open nonconformities by age
+- On-time completion of corrective actions
+- Share of actions with confirmed effectiveness
+- Recurrence rate of similar nonconformities
+
+## 9. Related documents
+
+- Corresponding policy: {{LINK:R03}}
+- Internal audits: {{LINK:VA-15}}
+- Management review and metrics: {{LINK:VA-22}}
+- Incident response: {{LINK:VA-01}}
+- Technical security baseline: {{LINK:BASELINE}}
+
+<!-- Fulfils the requirements listed under FULFILLS above; coupling in mapping-iso.json. Not visible in reading mode. -->
@@ -0,0 +1,77 @@
+# Management Review & Metrics
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-22) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_ISB}} |
+| Approved by | {{ROLE_MANAGEMENT}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 9.1-1, 9.3-1 | POLICY R03 -->
+
+## 1. Purpose
+
+This procedure governs how information security performance is measured and evaluated and how top management reviews the ISMS at planned intervals. It elaborates the corresponding policy ({{LINK:R03}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}) to all information security metrics and to the management review of the ISMS.
+
+## 3. Trigger
+
+Measurement interval of the respective metric, date of the management review (BL-GOV-02), significant changes within the scope, severe incident.
+
+## 4. Inputs
+
+- Metrics sheet with target values and owners ({{TOOL_NAME}})
+- Audit results and open findings ({{LINK:VA-15}})
+- Nonconformities and corrective actions ({{LINK:VA-21}})
+- Risk assessment and status of the risk treatment plan ({{LINK:VA-09}})
+- Incidents and reporting obligations ({{LINK:VA-01}})
+- Feedback from interested parties
+
+## 5. Process
+
+1. **Define metrics:** for each metric determine what is measured, by which method and data source, at which interval, who measures, when it is analysed and who analyses it.
+2. **Measure:** collect the values at the defined interval and record them in {{TOOL_NAME}}.
+3. **Analyse:** evaluate the results against the target values and form trends; a deviation from the target value raises a nonconformity ({{LINK:VA-21}}).
+4. **Prepare the management review:** compile the inputs — status of actions from previous reviews, changes in relevant internal and external issues and in the requirements of interested parties, feedback on information security performance, feedback from interested parties, results of the risk assessment, opportunities for improvement.
+5. **Conduct the review:** {{ROLE_MANAGEMENT}} reviews the ISMS at the interval {{MGMT_REVIEW_CYCLE}} against the fixed agenda (BL-GOV-02).
+6. **Take decisions:** decisions on opportunities for improvement and on any need to change the ISMS, each with a responsible role and a due date.
+7. **Record and follow up:** retain the minutes in {{TOOL_NAME}}; track the decisions through to completion.
+
+## 6. RACI
+
+| # | Step | R (execution) | A (accountable) | C (consulted) | I (informed) |
+|---|------|---------------|-----------------|---------------|--------------|
+| 1 | Define metrics | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | {{ROLE_IT_LEAD}} | Business units |
+| 2 | Measure | Metric owner | {{ROLE_ISB}} | - | - |
+| 3 | Analyse | {{ROLE_ISB}} | {{ROLE_ISB}} | Business unit | - |
+| 4 | Prepare the review | {{ROLE_ISB}} | {{ROLE_ISB}} | {{ROLE_IT_LEAD}} | - |
+| 5 | Conduct the review | {{ROLE_MANAGEMENT}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | Business units |
+| 6 | Take decisions | {{ROLE_MANAGEMENT}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 7 | Record and follow up | {{ROLE_ISB}} | {{ROLE_ISB}} | - | {{ROLE_MANAGEMENT}} |
+
+## 7. Result & evidence
+
+A maintained metrics sheet with measured values per period and minutes of the management review with decisions, owners and due dates. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Share of metrics actually collected at the defined interval
+- Share of metrics within their target value
+- On-time completion of decisions from the management review
+
+## 9. Related documents
+
+- Corresponding policy: {{LINK:R03}}
+- Nonconformities and corrective actions: {{LINK:VA-21}}
+- Internal audits: {{LINK:VA-15}}
+- Risk management procedure: {{LINK:VA-09}}
+- Technical security baseline: {{LINK:BASELINE}}
+
+<!-- Fulfils the requirements listed under FULFILLS above; coupling in mapping-iso.json. Not visible in reading mode. -->