Filed on the intranet is not made known

The IT usage policy has been revised and approved. It is on the intranet, the circular email has gone out, the matter is closed. In the audit comes the question: how do you make sure staff know the policy? The answer: it is on the intranet.

That answers the question of where the policy is. Not who knows it.

What IT-Grundschutz requires

Module ORP.1 Organisation requires in A16 a policy on secure IT use, with security objectives, roles, a contact person and the measures staff have to implement themselves. What distinguishes such a policy from a security policy statement was covered in A policy is not a guideline. For making it known, A16 contains three sentences, in German:

„Die Richtlinie SOLLTE allen Benutzenden zur Kenntnis gegeben werden. Jeder neue Benutzende SOLLTE die Kenntnisnahme und Beachtung der Richtlinie schriftlich bestätigen, bevor er die Informationstechnik nutzen darf. Benutzende SOLLTEN die Richtlinie regelmäßig oder nach größeren Änderungen erneut bestätigen.“

In short: the policy should be made known to all users, every new user should confirm in writing that they have read and will follow it before they may use IT, and users should confirm it again regularly or after major changes.

The intranet appears in the requirement too, but elsewhere: the policy should be filed so that all staff can freely read it, for example on the intranet. Filing is the place to read it. The evidence is the confirmation.

Where the circular email falls short

• New staff. The email went to everyone who was there at the time. Whoever starts next month never receives it, and the requirement asks for confirmation before the first use of IT, not at some point.
• The changed version. Whoever confirmed the old policy two years ago has not confirmed the new one. After a major change, the count starts again.
• Whoever is away. Parental leave, illness, six months on a project at a client. Afterwards, the email is buried under three hundred others. Without a list of open confirmations, nobody notices they are missing.

A rate without a version therefore says little. "92 per cent have confirmed" only means something if it says which version, and who the remaining eight per cent are.

How isidaten handles this

In policy management, acknowledgement applies per approved version: if a new version is approved, everyone has to confirm again, while a mere typo fix without a new approval does not trigger this. The audience consists of people, person groups or teams, and only members of it are counted. Each confirmation records person, version, time and a checksum of the content, with a signature if desired. Open acknowledgements are reminded at most once a week. Anyone who is absent gets a time-limited exception and drops out of the rate for that period instead of silently lowering it. If an escalation is set up for the policy, it proceeds in stages, in the standard setting after three days to the line manager and after seven to HR or compliance. isidaten does not block access to IT; that remains part of the onboarding process. But it shows who has not yet confirmed the current version.

The test question

How many of the staff who have started since the last major change to your IT usage policy have confirmed exactly that version?

If you first have to ask HR, the policy has been filed, but not made known.

Sources

BSI IT-Grundschutz Kompendium, 2023 edition, module ORP.1 Organisation, requirement A16 (German).