Basic terms
All 8 isidaten articles on Basic terms, newest first.
An attestation is not a certificate
Basic terms, part 8: The supplier questionnaire says "ISO 27001 certified", "C5 attestation", "BSI-tested" or "accredited". Four answers that sound alike and mean different things. Who checks, who checks the checker, and what ends up on paper: certification, accreditation and attestation, with the passages from EU law, the BSI Act and the BSI's C5.
Read more
A Grundschutz check is not an audit
Basic terms, part 7: "We had an audit in spring." Often it was an IT-Grundschutz check that the information security officer carried out with the responsible staff. That is valuable, but something else. BSI Standard 200-2 distinguishes three kinds of review: the check as a target/actual comparison, the IS audit as a regular review of effectiveness, and the audit by independent bodies. Who reviews, against what, and with what consequence.
Read more
A requirement is not a measure
Basic terms, part 6: "Has the measure been implemented?" Someone from IT-Grundschutz means something different by that than someone working to ISO 27001. The BSI Kompendium cleanly separates module, requirement and measure: what is being secured, what must be fulfilled and how it is fulfilled in your organisation. In the German ISO version, however, the control is called "Maßnahme" (measure). The same word, two levels.
Read more
A policy is not a guideline
Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.
Read more
The server is not the crown jewel
Basic terms, part 4: information domain, target object and asset are treated in everyday practice as the same thing as an inventory. IT-Grundschutz means three different things, and none of them is a device list. Why 3,000 clients can be one target object and the crown jewel is never a system.
Read more
Core is not the middle
Basic terms, part 3: basic, core and standard safeguarding are drawn as a staircase in almost every presentation. BSI Standard 200-2 describes something else: three approaches for three situations, on two axes. Anyone who takes core safeguarding for the middle step underestimates it.
Read more
How bad is not how fast
Basic terms, part 2: protection needs assessment and business impact analysis both ask about damage, but about different damage. One has no clock, the other lives by it. Why the BSI itself warns against merging them, and what separates normal operation from emergency operation.
Read more
A threat is not a hazard
Basic Terms, part 1: threat, vulnerability, hazard and risk build on one another in IT-Grundschutz and mean four different things. Plus the term the BSI abolished in 2017 that almost everyone still uses.
Read more