Security concept

A security concept is the central steering document of information security. It describes in a coherent way which information, systems and processes an organisation protects, what protection requirements exist for confidentiality, integrity and availability, and which technical and organisational measures (TOMs) are used to treat the identified risks. In doing so, it translates abstract security objectives into concrete, traceable and auditable specifications and forms the basis for audits, certifications and evidence required by authorities.In terms of content, a complete security concept typically covers the definition of the scope, the structural analysis of the information assets, the protection requirements assessment, a risk analysis with risk evaluation, and the catalogue of measures including responsibilities, implementation status and effectiveness monitoring. In practice it draws on established frameworks such as the BSI IT-Grundschutz, ISO/IEC 27001 or CISIS12 and is closely interlinked with the information security management system (ISMS), security policies and emergency or business continuity management.Legally and from a regulatory perspective, the security concept is becoming increasingly important: the NIS2 Directive and its national transposition require essential and important entities to have suitable, documented risk management measures, with senior management held liable for their implementation. DORA, sector-specific requirements and the demands of TISAX and certification bodies likewise presuppose a maintained, regularly updated security concept. It is not a static document but must be revised whenever there are significant changes to the IT landscape, the threat situation or the legal framework.