BSI IT-Grundschutz: start from a defensible draft.

Capture processes, information, applications, systems, connections and rooms in connected form.

Typical owner: Information security officer · Based on: BSI, KaitoSec

Document damage scenarios, protection goals, inheritance and justification under the four-eyes principle.

Typical owner: Business owner · Based on: BSI, KaitoSec

Connect modules, target objects, layers, adaptations and review status unambiguously.

Typical owner: Grundschutz team · Based on: BSI, BSI, KaitoSec

Capture requirement, target object, status, evidence, deviation and measure in an auditable way.

Typical owner: Assessment team · Based on: BSI, BSI, KaitoSec

Document additional threats, existing safeguards and supplementary measures.

Typical owner: Risk owner · Based on: BSI, KaitoSec

Capture time-critical processes, damage progression, recovery objectives and resource dependencies.

Typical owner: BCM officer · Based on: BSI, KaitoSec