The server is not the crown jewel

Anyone with an asset inventory often believes the structure analysis under IT-Grundschutz is thereby done: the devices are in a list, so the target objects are known. That is the most common short circuit when starting with the methodology, and it rests on treating three terms as the same thing that BSI Standard 200-2 and the Kompendium keep neatly apart.

Information domain: the scope

The information domain (Informationsverbund) is not a set of devices but the section the security concept applies to. Section 3.3.4 of the standard defines it (our translation):

"An information domain comprises the totality of infrastructural, organisational, personnel and technical components that serve the fulfilment of tasks in a particular area of information processing."

Four kinds of things, and only one of them is technology. Rooms, processes, people and systems belong to it on equal terms. And the domain can cover "the entire information processing of an institution or individual areas", such as a departmental network or an HR information system. Drawing the boundary is a decision, not a survey. Whoever does not make it has no domain, just a company.

Target object: what a module applies to

The Kompendium glossary is more precise here than many expect:

"Target objects are parts of the information domain to which one or more modules from the IT-Grundschutz Kompendium can be assigned in the course of modelling. Target objects can be physical objects, e.g. IT systems. Frequently, however, target objects are logical objects, such as organisational units, applications or the entire information domain."

A target object is thus defined by its use: it is what a module is applied to. Module ORP.4 has the whole institution as its target object, INF.2 a data centre, SYS.2.1 a client. And "frequently" target objects are not devices at all but applications, organisational units or the domain itself.

Then there is grouping. Section 8.1.1 of the standard says it is "frequently not expedient to record every object individually" and names four conditions under which objects form one target object: same type, similar tasks, similar conditions, same protection needs. 3,000 workstations with the same image, the same task and normal protection needs are one target object. In the inventory they are 3,000 rows. Both are correct; they are two different questions.

Asset: the target object that is worth something

The third term only entered the standard in 2017; the change history notes for version 1.0 the "change of the term ‘Aktiva’ to ‘Assets’". The glossary explains why the word "value" is avoided: in German it is "a term laden with many meanings", and then the decisive sentence:

"In IT-Grundschutz the term ‘assets’ is used in the sense of ‘valuable target objects’."

An asset is accordingly not a separate object type but a target object with a property: it is needed for the business purpose. That is narrower than the usage in IT asset management, where every device is an asset because it was bought.

Crown jewels: information, not systems

The difference is clearest with the critical assets. Section 7.3 of the standard, which prepares the core protection approach, lays down:

"Crown jewels are information or business processes, not services, applications, IT systems or similar objects."

The database server holding the design data is not the crown jewel. The design data is. The server is a target object to which module SYS.1.1 applies and which inherits the protection needs of the data it processes. Whoever keeps the crown jewels as a list of systems has skipped the question of what is to be protected and arrived directly at the question of with what.

What IT-Grundschutz models and what it does not

The three terms form a chain. The information domain is the section. The target objects are its parts, grouped so that modules apply to them. Assets are the target objects needed for the purpose, and crown jewels the information and processes among them without which the institution does not survive.

An inventory supplies the raw data for the second step. It does not supply the boundary, the grouping or the decision about what is valuable. That is not a weakness of the inventory; it answers a different question: what do we have. The structure analysis asks: what belongs, and what of it counts.

In isidaten the IT systems of the inventory therefore point at target object categories in the IT-Grundschutz cockpit, with inheritance and coverage, instead of being the target objects themselves.

Sources

BSI Standard 200-2 (IT-Grundschutz methodology) (German), section 3.3.4 "Determining the scope", section 7.3 "Identifying and defining the critical assets (crown jewels)", section 8.1.1 "Reducing complexity through grouping", change history version 1.0 (October 2017). IT-Grundschutz Kompendium, 2023 edition (German), glossary (assets, information domain, target object) and chapter "Layer model and modelling". Quotations are our translations.

In the next part: policy, guideline, concept, work instruction. Four levels, different bindingness and different approvers.

The previous part: Core is not the middle.