S 3.45 Planning training contents on information security

Initiation responsibility: IT Security Officer, Head of Personnel

Implementation responsibility: IT Security Officer, PBX System Manager, Personnel Department

All employees should possess sound expert knowledge of their workplaces and should also be familiar with issues relating to information security in this context.

To ensure this, there should be training courses on information security tailored to the different target groups, for example for employees from the various specialised areas, supervisors, people responsible for information security, people responsible for IT, administrators, etc.

At the beginning of a training course, the level of qualification of the employees and their training requirements must be analysed. The following facts should be obtained from the employees for this purpose:

The contents of the training course should be divided into modules so that each target group can be trained sufficiently and to the extent required. Important contents of various training modules are described in the following that must be selected and prepared according to the roles assumed by the respective groups of people. This overview is intended to help select the appropriate contents when conducting internal training events or to decide which external training programmes to select. In addition, all modules in the IT-Grundschutz Catalogues that are relevant for the respective information system should be examined to check if the necessary safeguards were not only ordered, but employees have also been trained in them.

The modules described here should be assigned to the target groups as shown in the following sample matrix. In the matrix, an "X" indicates that the particular module is recommended for the corresponding role. Optional training modules are marked with an "O", i.e. it is necessary to decide on a case-by-case basis if the contents of the particular training module are required for the corresponding role.

Training modules

Module 1: Basic concepts of information security

Module 2: Information security at the workplace

Module 3: Laws and regulations

Module 4: The organisation's security concept

Module 5: Risk management

Module 6: Information security management

Module 7: IT system

Module 8: Operational area

Module 9: Technical implementation of security safeguards

Module 10: Contingency planning/emergency planning

Module 11: New developments in the IT sector

Module 12: The business side of information security

Module 13: Infrastructure security

Module / Role 1 2 3 4 5 6 7 8 9 10 11 12 13
Supervisor X X X X             O X  
Security Management X X X X X X X X X X X X X
Data Protection Officer X X X X             X O  
Person responsible for infrastructure X X X X X O       X     X
User X X                      
Administrators X X   X X   X X X X X   O

Table: Suggested training modules for each role

Modules 1 and 2 both serve as basic training for all employees. Module 3 and the modules following thereafter specify which areas of specialisation need to be taught additionally for each specialised task.

Depending on the type of organisation, it may make sense to define additional target groups and corresponding training goals for each group, for example administration employees or security service personnel, with particular focus on the tasks of each role and on their basic knowledge of IT. During IT security training, it is important not to forget the personnel that are not directly associated with IT such as security guards and cleaning personnel. However, complex training modules are generally not necessary for such personnel.

Module 1: Basic concepts of information security

In view of the considerable benefits of sensible IT usage and how it makes routine work so much easier, the serious risks that can be incurred by the all too careless or even negligent handling of this technology must not be forgotten. Therefore, one of the most important tasks of the training concept is to raise the awareness of the employees for the topic of information security. The training concept should include the following subjects, amongst other things:

Module 2: Information security at the workplace

Employees can often contribute significantly to preventing damage just by taking simple precautionary measures. The module addressing the implementation of information security at the workplace should focus primarily on the following subjects, amongst other things:

The subjects specified above are just a selection. An "information security at the workplace" training module should always be adapted to the individual requirements of the corresponding organisation.

Module 3: Laws and regulations

This training module should outline the legal framework in which all people bearing responsibility in the IT department act. In many cases, the promise made by the employees to follow all relevant laws, regulations, and policies is just a formality that is usually performed when they start working at an organisation. However, it is not only important to oblige all employees to follow such rules, but also to inform them of the corresponding regulations, why they exist, and what effects they have.

The module should provide a general overview of the laws and provisions that may affect IT operations and/or information security. The applicable laws and provisions may differ greatly depending on the industry and country the organisation operates in. In addition, the standards and policies for IT usage and for information security the employees need to follow in their organisation should be presented.

This includes, for example:

Module 4: The organisation's security concept

This training module serves to provide more in-depth knowledge of the introductory subjects addressed in the corresponding basic module "Information security at the workplace". Furthermore, it is intended to enable the persons responsible for systems and tasks to contribute to the continuous updating and - due to new technical, organisational, or legal developments - adaptation processes of the security concept.

This subject area includes the following contents, amongst other things:

Module 5: Risk management

This training module is intended to point out the basic threats posed for the information system to the persons in charge and to enable them to assess the risk to the organisation resulting from them. This subject area includes the following contents, amongst other things:

Module 6: Security Management

This training module points out the basic principles to persons in charge of information security in order to implement information security in the organisation. This subject area includes the following contents, amongst other things:

Module 7: IT system

This training module describes the control instruments that ensure compliance with the security standards in the various phases of the life cycle of IT systems.

This subject area includes the following contents, amongst other things:

Module 8: Operational area

This training module describes the procedures and safeguards that protect the systems and applications operated and used daily.

This subject area includes the following contents, amongst other things:

Module 9: Technical implementation of security safeguards

This training module conveys knowledge about the technical implementation options for the control and monitoring instruments described abstractly in modules 6 to 8.

This subject area includes the following contents, amongst other things:

Module 10: Contingency planning/emergency planning

This training module is intended to convey the basic principles needed to create a contingency and recovery plan. It is an advanced module addressing the same material as module 5 "Risk management".

This subject area includes the following contents, amongst other things:

Module 11: New developments in the IT sector

The rapid developments in the field of IT must also be taken into account in the training concept. This training module is therefore intended to inform IT system operators of new innovations in their field. To stay up-to-date, this seminar should be attended at regular intervals, for example once every 2 years.

This subject area includes the following contents, amongst other things:

Module 12: The business side of information security

This training module is intended especially for management and decision-makers to integrate information security throughout the business planning process.

This subject area includes the following contents, amongst other things:

Module 13: Infrastructure security

This module addresses the protection of information technology with the help of structural and technical safeguards. Important items include, amongst other things:

Review questions:

© Federal Office for Information Security. All rights reserved.