msolarczekandClaude Opus 5
c8e6f30a27
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
565 lines
9.3 KiB
JSON
565 lines
9.3 KiB
JSON
[
|
|
{
|
|
"control": "1.1.1",
|
|
"title": "IS-Leitlinie",
|
|
"policy": [
|
|
"L00"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.2.1",
|
|
"title": "ISMS/Geltungsbereich",
|
|
"policy": [
|
|
"R01"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.2.2",
|
|
"title": "Rollen & Verantwortlichkeiten",
|
|
"policy": [
|
|
"R01"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.2.3",
|
|
"title": "Projektklassifizierung",
|
|
"policy": [
|
|
"R01"
|
|
],
|
|
"verfahren": [
|
|
"VA-19"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.3.1",
|
|
"title": "Identifizierung Informationswerte",
|
|
"policy": [
|
|
"R02"
|
|
],
|
|
"verfahren": [
|
|
"VA-08"
|
|
],
|
|
"needsAsset": true,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.3.2",
|
|
"title": "Klassifizierung Informationswerte",
|
|
"policy": [
|
|
"R02"
|
|
],
|
|
"verfahren": [
|
|
"VA-08"
|
|
],
|
|
"needsAsset": true,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.3.3",
|
|
"title": "Externe IT-Dienste",
|
|
"policy": [
|
|
"R02"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.3.4",
|
|
"title": "Software-Freigabe",
|
|
"policy": [
|
|
"R02"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.4.1",
|
|
"title": "Risikomanagement",
|
|
"policy": [
|
|
"R03"
|
|
],
|
|
"verfahren": [
|
|
"VA-09"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": true,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.5.1",
|
|
"title": "Compliance-/Richtlinienprüfung",
|
|
"policy": [
|
|
"R03"
|
|
],
|
|
"verfahren": [
|
|
"VA-15"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.5.2",
|
|
"title": "Unabhängige Überprüfung",
|
|
"policy": [
|
|
"R03"
|
|
],
|
|
"verfahren": [
|
|
"VA-15"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.6.1",
|
|
"title": "Meldung Sicherheitsereignisse",
|
|
"policy": [
|
|
"R04"
|
|
],
|
|
"verfahren": [
|
|
"VA-01"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.6.2",
|
|
"title": "Behandlung Sicherheitsereignisse",
|
|
"policy": [
|
|
"R04"
|
|
],
|
|
"verfahren": [
|
|
"VA-01"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "1.6.3",
|
|
"title": "Krisen-/Notfallmanagement",
|
|
"policy": [
|
|
"R04"
|
|
],
|
|
"verfahren": [
|
|
"VA-02"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "2.1.1",
|
|
"title": "Personalprüfung (Eignung/Identität)",
|
|
"policy": [
|
|
"R05"
|
|
],
|
|
"verfahren": [
|
|
"VA-14"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "2.1.2",
|
|
"title": "Verpflichtungen (NDA/Richtlinien)",
|
|
"policy": [
|
|
"R05"
|
|
],
|
|
"verfahren": [
|
|
"VA-14"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "2.1.3",
|
|
"title": "Schulung & Sensibilisierung",
|
|
"policy": [
|
|
"R05"
|
|
],
|
|
"verfahren": [
|
|
"VA-12"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "2.1.4",
|
|
"title": "Mobiles Arbeiten",
|
|
"policy": [
|
|
"R06"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "3.1.1",
|
|
"title": "Sicherheitszonenkonzept",
|
|
"policy": [
|
|
"R07"
|
|
],
|
|
"verfahren": [
|
|
"VA-17"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "3.1.4",
|
|
"title": "Mobile Geräte/Datenträger",
|
|
"policy": [
|
|
"R06"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "4.1.1",
|
|
"title": "Identifikationsmittel (Lebenszyklus)",
|
|
"policy": [
|
|
"R08"
|
|
],
|
|
"verfahren": [
|
|
"VA-03"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "4.1.2",
|
|
"title": "Benutzerauthentifizierung",
|
|
"policy": [
|
|
"R08"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "4.1.3",
|
|
"title": "Verwaltung Benutzerkonten",
|
|
"policy": [
|
|
"R08"
|
|
],
|
|
"verfahren": [
|
|
"VA-03"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "4.2.1",
|
|
"title": "Verwaltung Zugriffsrechte",
|
|
"policy": [
|
|
"R08"
|
|
],
|
|
"verfahren": [
|
|
"VA-03"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.1.1",
|
|
"title": "Kryptografie",
|
|
"policy": [
|
|
"R09"
|
|
],
|
|
"verfahren": [
|
|
"VA-07"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.1.2",
|
|
"title": "Netzdienste/sichere Übertragung",
|
|
"policy": [
|
|
"R09"
|
|
],
|
|
"verfahren": [
|
|
"VA-07"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.1",
|
|
"title": "Change-Management",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [
|
|
"VA-04"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.2",
|
|
"title": "Trennung Entw./Test/Prod",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.3",
|
|
"title": "Schutz vor Schadsoftware",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.4",
|
|
"title": "Protokollierung/Logging",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [
|
|
"VA-13"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.5",
|
|
"title": "Umgang mit Schwachstellen",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [
|
|
"VA-04",
|
|
"VA-06"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.6",
|
|
"title": "Prüfung von IT-Systemen (Audit)",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [
|
|
"VA-06"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.7",
|
|
"title": "Netzwerkmanagement",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.8",
|
|
"title": "Kontinuität IT-Dienste (BCM)",
|
|
"policy": [
|
|
"R04"
|
|
],
|
|
"verfahren": [
|
|
"VA-02"
|
|
],
|
|
"needsAsset": true,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.2.9",
|
|
"title": "Backup & Wiederherstellung",
|
|
"policy": [
|
|
"R10"
|
|
],
|
|
"verfahren": [
|
|
"VA-05"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.3.1",
|
|
"title": "Sichere Systementwicklung/Beschaffung",
|
|
"policy": [
|
|
"R11"
|
|
],
|
|
"verfahren": [
|
|
"VA-16"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.3.2",
|
|
"title": "Sicherheit Netzdienste",
|
|
"policy": [
|
|
"R11"
|
|
],
|
|
"verfahren": [
|
|
"VA-16"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.3.3",
|
|
"title": "Beendigung IT-Dienste (nur SOLL)",
|
|
"policy": [
|
|
"R11"
|
|
],
|
|
"verfahren": [],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.3.4",
|
|
"title": "Mandantentrennung (Cloud)",
|
|
"policy": [
|
|
"R12"
|
|
],
|
|
"verfahren": [
|
|
"VA-11"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "5.3.4-KI",
|
|
"title": "KI-/GenAI-Nutzung",
|
|
"policy": [
|
|
"R12"
|
|
],
|
|
"verfahren": [
|
|
"VA-11"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "6.1.1",
|
|
"title": "Lieferantenmanagement",
|
|
"policy": [
|
|
"R13"
|
|
],
|
|
"verfahren": [
|
|
"VA-10"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "6.1.2",
|
|
"title": "Vertraulichkeitsvereinbarungen",
|
|
"policy": [
|
|
"R13"
|
|
],
|
|
"verfahren": [
|
|
"VA-10"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "6.1.3",
|
|
"title": "Geteilte Verantwortlichkeiten (Shared Resp.)",
|
|
"policy": [
|
|
"R13"
|
|
],
|
|
"verfahren": [
|
|
"VA-10"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "7.1.1",
|
|
"title": "Rechtliche/vertragliche Vorgaben",
|
|
"policy": [
|
|
"R14"
|
|
],
|
|
"verfahren": [
|
|
"VA-18"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
},
|
|
{
|
|
"control": "7.1.2",
|
|
"title": "Datenschutz-relevante IS-Anforderungen",
|
|
"policy": [
|
|
"R14"
|
|
],
|
|
"verfahren": [
|
|
"VA-18"
|
|
],
|
|
"needsAsset": false,
|
|
"needsRisk": false,
|
|
"target": 3
|
|
}
|
|
]
|