General Provisions (ISDSDV)

**This Regulation Regulates the Principles and Procedure for the Implementation of Information Security and Data Protection (ISDP) in the Use of Information and Communication Technology (ICT) by the Cantonal Administration.**

This regulation deals with the principles and procedures for the implementation of information security and data protection (ISDP) when using information and telecommunication technology (ICT) by the cantonal administration.

1. This regulation applies to projects, applications, and components of ICT.

2. It applies to the entire cantonal administration.

3. When granting compensations under the State Contributions Act of September 16, 1992 (StBA) for ICT projects, whose data processing is subject to the KDSG, applicants must comply either with the substantive provisions of this regulation (Art. 5 and the technical directives according to Art. 12) or with the provisions of a recognized, equivalent ISDS standard.

1. Responsible for ISDS are those entities that process data, particularly personal data, to fulfill their legal duties or have such data processed by third parties (responsible entities).

2. If multiple entities process data jointly, it must be determined in writing which entity holds the primary responsibility for ISDS.

1. The responsible entity ensures that all ICT applications processing personal data comply with legal and contractual data protection regulations, and that information security is adequately guaranteed during data processing.

1. In every ICT project, the project committee shall appoint an ISDS officer within the framework of the project organization.

2. During the pre-analysis phase, the responsible body shall assess the data protection compliance of the project with an ISDS analysis and determine with a protection needs classification whether increased ISDS requirements exist for the project.

3. Increased ISDS requirements exist particularly if

a. The replacement value of the infrastructure is high,

b. A failure of the ICT systems for more than one working day has serious consequences for the fulfillment of assignments,

c. Data recovery is associated with significant problems or costs,

d. The processed data is subject to special legal or contractual confidentiality obligations (e.g., professional secrecy), or

e. A data protection breach has noticeably adverse consequences for the affected individuals, which generally applies to the processing of particularly sensitive personal data.

4. If the ISDS analysis reveals that no increased ISDS requirements exist, the responsible body shall ensure that, by the time of commissioning the ICT application, the relevant data protection requirements are met and information security is ensured at least through the implementation of ISDS basic protection measures.

5. If the ISDS analysis reveals that increased ISDS requirements exist, an ISDS concept must be developed at the latest during the concept phase. As part of this concept, based on a risk analysis,

a. The additional organizational and technical measures required for adequate information security and data protection after implementing the ISDS basic protection measures must be determined, and

b. The conditions must be established to ensure that these measures are implemented by the time of commissioning the ICT application.

1. Applications for credit approvals and documents for the prior review of data processing (Art. 17a KDSG) contain the developed ISDS documents. These must be endorsed by the ISDS officer responsible for the project.

2. If a project has increased ISDS requirements, the application for credit approval must include an opinion from the cantonal data protection supervisory authority, which assesses whether the KDSG and other ISDS provisions are being complied with (prior review report).

3. ISDS documents submitted to the cantonal data protection supervisory authority for comment must simultaneously be forwarded to the cantonal information security officer (IT-SIBE) (Art. 10).

4. When granting compensations to projects with ISDS conditions, for which an alternative ISDS standard has been selected (Art. 2 Para. 3), the documents required by the selected ISDS standard take the place of the ISDS analysis and concept. In this case, paragraphs 2 and 3 apply irrespective of whether the project has increased ISDS requirements or not, and upon request, the documents that define the selected ISDS standard itself must also be submitted.

1. If the ISDS analysis or a current ISDS concept is missing, or if the clarifications reveal that the project does not comply with data protection regulations or that information security is not ensured, the client shall only grant approval for the further project planning phase on the condition that the deficiencies are rectified, and operations may not commence before the deficiencies are remedied.

2. Information security is particularly not ensured if, upon commissioning the ICT application, there are still security risks assessed as high.

1. For the ICT applications that were not already subject to an ISDS analysis during the project phase, such an analysis must be conducted.

2. For the applications that, due to the protection needs classification, demonstrate an increased need for protection, an ISDS concept must be developed. This concept specifically includes a risk analysis and a mandatory action plan to eliminate high risks.

1. ICT Components are the tangible or intangible parts of the ICT infrastructure that serve for electronic data processing through applications, such as devices with or without their own processing functions, processes, or service offerings ("services").

2. For ICT components whose information security and data protection are not already covered by the ISDS concept of a project or application, at least the ISDS basic protection must be ensured.

3. If ISDS requirements for projects or applications for which the ICT components are used indicate a need for further protection, the entity responsible for the project shall implement the appropriate security and protection measures or ensure their implementation by the entity responsible for the ICT components.

4. The implementation of security and protection measures shall be documented in an appropriate form. The cantonal data protection supervision authority and the IT Security Officer shall be granted access to the documentation upon request.

1. **Supervision of Compliance with Data Protection Requirements and Assurance of Information Security in the Processing of Personal Data Rests with the Cantonal Data Protection Supervisory Authority (Art. 34 KDSG).**

2. The cantonal data protection supervisory authority collaborates with the IT Security Information Officer and is supported in its oversight by the IT Security Information Officer.

3. The IT Security Information Officer is responsible for supervising the assurance of information security in activities where no personal data is processed. He or she can be invited to participate in ICT projects in an advisory capacity.

4. Instructions relevant to the Information Security and Data Protection Standard (ISDS) from the authorities to which this regulation applies (Art. 2 para. 2) must be submitted to the cantonal data protection supervisory authority and the IT Security Information Officer for informational purposes at least one week prior to their issuance. In ISDS-relevant legislative projects, the cantonal data protection supervisory authority and the IT Security Information Officer must be involved in an appropriate manner.

The directorates and the state chancellery designate an information security officer (IT-SIVE) as the primary contact point for the IT-SIBE.

**1. The Office of Information and Organization (KAIO)** issues the necessary implementation instructions after consultation with the directorates, the state chancellery, the cantonal data protection supervisory authority, and the cantonal IT conference (KIK), particularly regarding

a) the ISDS analysis and protection requirement classification to be conducted in ICT projects,

b) the ISDS concept to be developed in ICT projects,

c) the ISDS basic protection to be observed,

d) the general ISDS terms and conditions of the canton (AGB ISDS), which must be mandatorily adhered to or prescribed for ICT projects.

**2.** The general ISDS terms and conditions as per paragraph 1, letter d, may stipulate that contractual regulations must include the ISDS fundamentals developed on a case-by-case basis pursuant to paragraph 1, letters a to c.

**3.** The KAIO provides suitable tools (explanations, checklists, etc.) and ensures an adequate consulting and training offering.

1. This regulation shall enter into force on April 1, 2011.