Schutzbedarfsfeststellung

Not every piece of information needs the same protection. A cafeteria menu is harmless, a salary list is not. The protection requirements assessment ensures that you apply your protective measures in the right places – including when it comes to how thoroughly old data carriers must be erased or destroyed.

What is a protection requirements assessment?

The term comes from the BSI IT-Grundschutz. The German Federal Office for Information Security (BSI) describes it in BSI Standard 200-2. The starting point is the business processes and the information processed in them. For each piece of information, one asks: what would be the worst realistic damage if it falls into the wrong hands, is falsified, or is not available?

The protection requirement is inherited by the systems that process this information. A server with personnel files therefore has a different protection requirement than a print server for the cafeteria.

Categories and assessment rules

Category	Meaning under BSI Standard 200-2
normal	The damage impacts are limited and manageable.
High	The damage impacts can be considerable.
very high	The damage impacts can reach a catastrophic scale that threatens the very existence of the organization.

Typical damage scenarios are assessed, such as violations of laws and contracts, impairment of the right to informational self-determination, financial consequences, or damage to reputation. Three rules apply in addition:

• Maximum principle: A system takes on the highest protection requirement of the information it processes.
• Accumulation effect: Many data items with normal protection requirements can together result in a higher protection requirement.
• Distribution effect: If information is distributed across several systems, the protection requirement of individual systems can be lower.

Protection requirement and data carrier destruction

For the physical destruction of data carriers, the DIN 66399 standard takes up the same idea. It has three protection classes that are based on the protection requirement of the data: protection class 1 for normal, 2 for high, and 3 for very high protection requirement. The protection class determines which security level is required at a minimum. More on this in the entry Protection class (DIN 66399) and in the guide DIN 66399: protection classes and security levels.

The GDPR also thinks in terms of risk: Art. 32 requires measures that are appropriate to the risk to the rights of the data subjects. The protection requirements assessment provides a comprehensible justification for this.

Protection requirement and Second IT

Once the protection requirement is clarified, the appropriate method can be chosen specifically. Second IT erases functional data carriers with Blancco and creates a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 at security level H-5. How the processing is protected can be read under Data security at Second IT.

Frequently asked questions about the protection requirements assessment

Who carries out the protection requirements assessment?

Usually the information security officers together with the heads of the business departments. They know the information and can best assess the consequences of damage. The results are justified in writing.

Is the protection requirements assessment required by law?

As a term, it is part of the BSI IT-Grundschutz, not of the GDPR. For authorities and companies that work according to IT-Grundschutz, it is mandatory. Others use it voluntarily to justify the risk-appropriate selection of measures required by the GDPR.

What does the protection requirement have to do with old hard drives?

The protection requirement of the stored data determines how thoroughly a hard drive must be erased or destroyed. With high or very high protection requirements, stricter methods and complete documentation for each data carrier are appropriate.

What is the maximum principle for protection requirements?

A system takes on the highest protection requirement of the information it processes. If personnel files and non-critical data are stored on a server, the protection requirement of the personnel files applies. This also determines how thoroughly the server must be erased when it is decommissioned.

What is the difference between protection requirement and protection class?

The protection requirement comes from the BSI IT-Grundschutz and has the levels normal, high, and very high. The protection class (1 to 3) comes from DIN 66399 and is based on it. It determines which security level is required at a minimum for destruction.