With the protection requirements assessment, you determine how much protection a piece of information or a process requires, separately for confidentiality, integrity and availability (called the determination of protection requirements in BSI Standard 200-2). Systems inherit the protection requirement of the information they process. This guide is aimed at asset owners, approvers and ISMS managers.

Before you start

  • The protection requirements assessment is active in every organisation and cannot be switched off.
  • Without an Approval workflow, no one can submit an assessment. The ISMS managers define it under ISMS settings › Assets › Protection requirements assessment: which functional roles approve at which step. There is no predefined workflow.
  • For information containing personal data and for systems that process such information, the Confirmation by data protection approver is also required. It is defined on the same page (for new organisations, the Data protection advisor functional role is preset; you can choose your own) and is added as the last step after the approval workflow. If no functional role has been defined for it, such assessments cannot be submitted.
  • The same page contains the Control questions & extent of damage (extent of damage is not the same as the impact of a risk), the validity or review interval, the floors per data category and your organisation's legal or regulatory requirements.
  • The assessment is carried out by the asset owner or by anyone with the permission to do so.

Which assets need an assessment

  • Information and processes (top-level category with the setting “Contains information and processes”): with control questions per security objective.
  • Systems, applications, buildings, service providers with a baseline check: only once a piece of information is linked to them, directly or via another asset (e.g. information that reaches an application also reaches the server it runs on). The protection requirement follows from this information.
  • Your organisation's asset: none
  1. OwnerData protection

    Which personal data does the information contain?

  2. OwnerControl questions per security objective

    For Yes, the worst-case extent of damage to be expected; No results in “normal”.

  3. Result per security objective

    Normal, high or very high; floors and legal or regulatory requirements raise it.

  4. ApproversApprove

    Step by step, with confirmation by data protection last if personal data is involved.

  5. Valid

    The highest protection requirement appears as criticality and passes on via the links.

Rejected

The owner receives the task “Revise protection requirements assessment”; their entries are pre-filled.

From the control questions to a valid protection requirement

For a piece of information, the owner first states which personal data it contains. Then the owner answers the control questions per security objective; for Yes, they estimate the extent of damage, and No results in normal. This gives the protection requirement normal, high or very high per security objective, raised by floors and legal or regulatory requirements. The approvers approve step by step, with confirmation by data protection last if personal data is involved. Only then does the result apply, appear as criticality and pass on via the links. If it is rejected, the owner revises the assessment.

How to proceed: information and processes

  1. Open the asset and switch to the Workflows tab. Or open the task Carry out protection requirements assessment under My tasks.
  2. Click Carry out protection requirements assessment.
  3. Step 1. Data protection: state which personal data the information contains.
  4. Step 2. Control questions: answer each question per security objective with Yes or No. For Yes, you estimate the worst-case extent of damage to be expected; three levels are preset, from “Minor damage” (normal) through “Considerable damage, but not threatening the organisation's existence” (high) to “Damage threatens the organisation's existence” (very high). No results in “normal”. With Copy answers from (optional), you adopt the answers of a similar asset and adjust them.
  5. Step 3. Special legislation & result: tick which legal or regulatory requirements apply and check the result (normal, high or very high per security objective).
  6. Click Submit for approval.

If a piece of information contains a data category for which your organisation has set a floor (preset for sensitive personal data), at least this floor applies to each security objective. Legal or regulatory requirements raise their security objectives to the floor stated for the requirement (usually “high”, sometimes “very high”).

How to proceed: systems

  1. In the asset form, under Linked assets, link the information that the system processes.
  2. As soon as the assessments of all linked information have been approved, the system owner receives the task Carry out protection requirements assessment.
  3. The dialog shows the information processed, including information reached via other assets. For each security objective, the highest protection requirement of this information applies (maximum principle).
  4. If the system processes personal data with a high protection requirement, a Risk pre-assessment follows. According to your organisation's criteria, it determines whether a data protection impact assessment (DPIA) is required.
  5. If legal or regulatory requirements apply to a piece of information, define one measure of the system for each of them. It does not yet need to be implemented for submission.
  6. Submit the assessment with Submit for approval.

What happens next

  • The approvers of the first step receive the task Approve protection requirements assessment. Each step approves in turn.
  • Whoever submitted it cannot approve it themselves (four-eyes principle). If there is no one apart from you in an approver role, submitting is blocked until the functional role has another member.
  • If an approver rejects it with a justification, you receive the task Revise protection requirements assessment. Your entries are pre-filled.
  • The result only applies with the last approval. The highest protection requirement across all security objectives appears on the asset as Criticality. Varmo passes the protection requirement on via the links to applications, IT systems, rooms and service providers, depending on their position in the dependency chain. After that, the baseline check begins for systems.
  • If a piece of information is newly linked or removed, the system needs a new assessment. If the assessment of a processed piece of information is approved again, the system owner starts a review with Start review.
  • Once the review interval has expired, the owner receives the task Review protection requirements assessment.

Frequently asked questions

Why can't I submit the assessment of a system yet?

The system waits until the assessments of all linked information have been approved. Without linked information, no assessment is needed. If you remove the last linked piece of information, however, a new assessment is needed: once it is approved, no elevated protection requirement applies to the system any more.

Who approves the assessment?

The functional roles in your organisation's approval workflow, plus data protection for personal data. See Managing approvals with the four-eyes principle.

Can I adjust the questions?

Yes. The ISMS managers maintain the control questions and extent of damage under ISMS settings › Assets › Protection requirements assessment. Changes apply to future assessments.