[
  {
    "control": "1.1.1",
    "title": "IS-Leitlinie",
    "policy": [
      "L00"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.2.1",
    "title": "ISMS/Geltungsbereich",
    "policy": [
      "R01"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.2.2",
    "title": "Rollen & Verantwortlichkeiten",
    "policy": [
      "R01"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.2.3",
    "title": "Projektklassifizierung",
    "policy": [
      "R01"
    ],
    "verfahren": [
      "VA-19"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.3.1",
    "title": "Identifizierung Informationswerte",
    "policy": [
      "R02"
    ],
    "verfahren": [
      "VA-08"
    ],
    "needsAsset": true,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.3.2",
    "title": "Klassifizierung Informationswerte",
    "policy": [
      "R02"
    ],
    "verfahren": [
      "VA-08"
    ],
    "needsAsset": true,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.3.3",
    "title": "Externe IT-Dienste",
    "policy": [
      "R02"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.3.4",
    "title": "Software-Freigabe",
    "policy": [
      "R02"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.4.1",
    "title": "Risikomanagement",
    "policy": [
      "R03"
    ],
    "verfahren": [
      "VA-09"
    ],
    "needsAsset": false,
    "needsRisk": true,
    "target": 3
  },
  {
    "control": "1.5.1",
    "title": "Compliance-/Richtlinienprüfung",
    "policy": [
      "R03"
    ],
    "verfahren": [
      "VA-15"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.5.2",
    "title": "Unabhängige Überprüfung",
    "policy": [
      "R03"
    ],
    "verfahren": [
      "VA-15"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.6.1",
    "title": "Meldung Sicherheitsereignisse",
    "policy": [
      "R04"
    ],
    "verfahren": [
      "VA-01"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.6.2",
    "title": "Behandlung Sicherheitsereignisse",
    "policy": [
      "R04"
    ],
    "verfahren": [
      "VA-01"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "1.6.3",
    "title": "Krisen-/Notfallmanagement",
    "policy": [
      "R04"
    ],
    "verfahren": [
      "VA-02"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "2.1.1",
    "title": "Personalprüfung (Eignung/Identität)",
    "policy": [
      "R05"
    ],
    "verfahren": [
      "VA-14"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "2.1.2",
    "title": "Verpflichtungen (NDA/Richtlinien)",
    "policy": [
      "R05"
    ],
    "verfahren": [
      "VA-14"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "2.1.3",
    "title": "Schulung & Sensibilisierung",
    "policy": [
      "R05"
    ],
    "verfahren": [
      "VA-12"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "2.1.4",
    "title": "Mobiles Arbeiten",
    "policy": [
      "R06"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "3.1.1",
    "title": "Sicherheitszonenkonzept",
    "policy": [
      "R07"
    ],
    "verfahren": [
      "VA-17"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "3.1.4",
    "title": "Mobile Geräte/Datenträger",
    "policy": [
      "R06"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "4.1.1",
    "title": "Identifikationsmittel (Lebenszyklus)",
    "policy": [
      "R08"
    ],
    "verfahren": [
      "VA-03"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "4.1.2",
    "title": "Benutzerauthentifizierung",
    "policy": [
      "R08"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "4.1.3",
    "title": "Verwaltung Benutzerkonten",
    "policy": [
      "R08"
    ],
    "verfahren": [
      "VA-03"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "4.2.1",
    "title": "Verwaltung Zugriffsrechte",
    "policy": [
      "R08"
    ],
    "verfahren": [
      "VA-03"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.1.1",
    "title": "Kryptografie",
    "policy": [
      "R09"
    ],
    "verfahren": [
      "VA-07"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.1.2",
    "title": "Netzdienste/sichere Übertragung",
    "policy": [
      "R09"
    ],
    "verfahren": [
      "VA-07"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.1",
    "title": "Change-Management",
    "policy": [
      "R10"
    ],
    "verfahren": [
      "VA-04"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.2",
    "title": "Trennung Entw./Test/Prod",
    "policy": [
      "R10"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.3",
    "title": "Schutz vor Schadsoftware",
    "policy": [
      "R10"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.4",
    "title": "Protokollierung/Logging",
    "policy": [
      "R10"
    ],
    "verfahren": [
      "VA-13"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.5",
    "title": "Umgang mit Schwachstellen",
    "policy": [
      "R10"
    ],
    "verfahren": [
      "VA-04",
      "VA-06"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.6",
    "title": "Prüfung von IT-Systemen (Audit)",
    "policy": [
      "R10"
    ],
    "verfahren": [
      "VA-06"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.7",
    "title": "Netzwerkmanagement",
    "policy": [
      "R10"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.8",
    "title": "Kontinuität IT-Dienste (BCM)",
    "policy": [
      "R04"
    ],
    "verfahren": [
      "VA-02"
    ],
    "needsAsset": true,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.2.9",
    "title": "Backup & Wiederherstellung",
    "policy": [
      "R10"
    ],
    "verfahren": [
      "VA-05"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.3.1",
    "title": "Sichere Systementwicklung/Beschaffung",
    "policy": [
      "R11"
    ],
    "verfahren": [
      "VA-16"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.3.2",
    "title": "Sicherheit Netzdienste",
    "policy": [
      "R11"
    ],
    "verfahren": [
      "VA-16"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.3.3",
    "title": "Beendigung IT-Dienste (nur SOLL)",
    "policy": [
      "R11"
    ],
    "verfahren": [],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.3.4",
    "title": "Mandantentrennung (Cloud)",
    "policy": [
      "R12"
    ],
    "verfahren": [
      "VA-11"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "5.3.4-KI",
    "title": "KI-/GenAI-Nutzung",
    "policy": [
      "R12"
    ],
    "verfahren": [
      "VA-11"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "6.1.1",
    "title": "Lieferantenmanagement",
    "policy": [
      "R13"
    ],
    "verfahren": [
      "VA-10"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "6.1.2",
    "title": "Vertraulichkeitsvereinbarungen",
    "policy": [
      "R13"
    ],
    "verfahren": [
      "VA-10"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "6.1.3",
    "title": "Geteilte Verantwortlichkeiten (Shared Resp.)",
    "policy": [
      "R13"
    ],
    "verfahren": [
      "VA-10"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "7.1.1",
    "title": "Rechtliche/vertragliche Vorgaben",
    "policy": [
      "R14"
    ],
    "verfahren": [
      "VA-18"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  },
  {
    "control": "7.1.2",
    "title": "Datenschutz-relevante IS-Anforderungen",
    "policy": [
      "R14"
    ],
    "verfahren": [
      "VA-18"
    ],
    "needsAsset": false,
    "needsRisk": false,
    "target": 3
  }
]