Information Security Assessment ISA5.txt

No.	Subject
1.1.1	To what extent are information security policies available?
1.2.1	To what extent is information security managed within the organization?
1.2.2	To what extent are information security responsibilities organized?
1.2.3	To what extent are information security requirements taken into account in projects?
1.2.4	To what extent are responsibilities between external IT service providers and the own organization defined?
1.3.1	To what extent are information assets identified and recorded?
1.3.2	To what extent are information assets classified and managed in terms of their protection needs?
1.3.3	To what extent is it ensured that only evaluated and approved external IT services are used for processing the organization’s information assets?
1.4.1	To what extent are information security risks managed?
1.5.1	To what extent is compliance with information security ensured in procedures and processes?
1.5.2	To what extent is the ISMS reviewed by an independent entity?
1.6.1	To what extent are information security events processed?
2.1.1	To what extent is the suitability of employees for sensitive work fields ensured?
2.1.2	To what extent is all staff contractually bound to comply with information security policies?
2.1.3	To what extent is staff made aware of and trained with respect to the risks arising from the handling of information?
2.1.4	To what extent is teleworking regulated?
3.1.1	To what extent are security zones managed to protect information assets?
3.1.2	To what extent is information security ensured in exceptional situations?
3.1.3	To what extent is the handling of supporting assets managed?
3.1.4	To what extent is the handling of mobile IT devices and mobile data storage devices managed?
4.1.1	To what extent is the use of identification means managed?
4.1.2	To what extent is the user access to network services, IT systems and IT applications secured?
4.1.3	To what extent are user accounts and login information securely managed and applied?
4.2.1	To what extent are access rights assigned and managed?
5.1.1	To what extent is the use of cryptographic procedures managed?
5.1.2	To what extent is information protected during transport?
5.2.1	To what extent are changes managed?
5.2.2	To what extent are development and testing environments separated from operational environments?
5.2.3	To what extent are IT systems protected against malware?
5.2.4	To what extent are event logs recorded and analyzed?
5.2.5	To what extent are vulnerabilities identified and addressed?
5.2.6	To what extent are IT systems technically checked (system audit)?
5.2.7	To what extent is the network of the organization managed?
5.3.1	To what extent is information security considered in new or further development of IT systems?
5.3.2	To what extent are requirements for network services defined?
5.3.3	To what extent is the return and secure removal of information assets from external IT services regulated?
5.3.4	To what extent is information protected in shared external IT services?
6.1.1	To what extent is information security ensured among suppliers and cooperation partners?
6.1.2	To what extent is non-disclosure regarding the exchange of information contractually agreed?
7.1.1	To what extent is compliance with regulatory and contractual provisions ensured?
7.1.2	To what extent is the protection of personal data taken into account when implementing information security?