Ordinance on Information Security (ISV) - Subject Matter and Purpose (ISB)

1. This ordinance regulates information security in the Canton of Basel-Stadt.

2. The purpose of information security is to ensure the confidentiality, integrity, and availability of information, as well as the accountability and traceability of actions or processes relating to this information through appropriate measures.

1. This regulation applies to the organizational units of the canton as defined in § 3 para. 1 lit. a IDG, with the exception of the courts.

1. The government council holds overall responsibility for information security.

2. It establishes the information security strategy and manages the implementation of the information security strategy with an information security management system, ensuring its timely adaptation to changing circumstances.

1. The Information Security Steering Committee acts as an advisory body to the Government Council and submits proposals for the adaptation of the information security strategy. The chairperson of the Information Security Steering Committee reports to the Government Council annually on the achievement of the strategy's goals within the departments.

2. The Information Security Steering Committee issues directives and monitors their compliance through an annual report from the cantonal Information Security Officer (ISO).

3. It makes final decisions on exceptions to information security measures.

1. The Information Security Officer (ISO) conducts the central department for information security and has the following tasks

a) the development of the information security strategy taking into account the cantonal IT strategy;

b) the preparation of an annual report on information security for the information security steering body;

c) the assessment of canton-wide information security risks based on recognized methods;

d) the review of protection needs and risk analyses conducted by the data owner and the recommendation of risk-reducing measures;

e) the creation and updating of a directory of existing information assets and information and communication technology applications (ICT applications), including a list of the respective responsible data owner, the protection level, and the maintenance of a risk and exceptions register;

f) the leadership of the Information Security Commission;

g) the support of the information security steering body and the departments in carrying out their tasks to ensure compliance with information security;

h) the conduct of information security audits in the departments in consultation with the central service provider;

i) the decision-making in the first instance regarding exceptions to information security measures - the approvals must be time-limited;

j) the development of implementation provisions for the execution of the information security strategy.

1. The Information Security Commission supports the governing body for information security and the Information Security Officer(s) in carrying out their assigned tactical tasks.

2. It coordinates the activities of the departmental Information Security Officers (ISBD) and develops awareness campaigns for the governing body for information security.

1. The departments ensure the operational implementation of the information security strategy with appropriate measures and the Information Security Management System, as well as an annual report to the Information Security Officer (ISB).

2. Each department appoints an Information Security Department Officer (ISBD) who supports the departments in implementing measures and reporting according to paragraph 1.

3. The responsibilities of the departments include, in particular

a) providing financial and personnel resources for the implementation of information security measures;

b) creating a directory of existing information assets and ICT applications, their protection levels, including the designation of the responsible data owner, as well as a risk register;

c) regularly updating the directory according to letter b and reporting changes to the ISBD.

**1. Responsibility for Handling Information**

The responsibility for handling information lies with the public body that processes the information to fulfill its legal duties. This body is particularly responsible for determining the protection needs of existing information holdings and ICT applications according to the protection objectives as per § 8 para. 2 IDG. If a corresponding determination indicates a need for protection exceeding the basic protection, a risk analysis including a mitigation plan must be conducted.

**2. Annual Review and Content of the Mitigation Plan**

The mitigation plan must be reviewed annually for its appropriateness and currency and must include regulations on at least the following points as part of the basic protection

a) the creation and management of an access and authorization concept;

b) data retention and deletion in compliance with archival regulations;

c) secure information exchange with third parties;

d) the involvement of employees in the security process, and

e) the documentation of approved and rejected exemptions from information security measures, as well as the risk register.

**3. Reporting on Implementation of Information Security Measures**

The data owner reports on the implementation of information security measures within the scope of the annual departmental reporting.

1. The ISBD (Information Security and Data Protection Officer)

a) serves as the point of contact for the ISB (Information Security Board) and the Data Protection Officer;

b) maintains and updates a risk register at the departmental level and documents the exemptions granted;

c) reviews the implementation of organizational and technical security measures;

d) recommends security measures for implementation;

e) acts as the central contact point for security issues in the field of ICT applications;

f) assists the department leadership in establishing organizational security guidelines;

g) supports the data owner in ensuring that information within the department is protected by appropriate organizational and technical measures;

h) manages internal and external security audits;

i) reports technical information security vulnerabilities to the ISB;

j) represents the department in the Information Security Commission;

k) organizes informational events on information security at the departmental level.

1. The central service provider is responsible for the development, procurement, provision, and maintenance of ICT applications as well as the compliance with and implementation of the requirements in the field of information security, which the departments need to fulfill their legal tasks in compliance with data protection and information security regulations, provided that these applications are not procured in a decentralized manner.

2. If ICT applications are obtained from third parties, it must be ensured that they comply with the requirements according to paragraph 1.

3. The central service provider prepares the corresponding report in accordance with § 7 paragraph 1.

4. The information security officer of the central service provider (ISBZ) assumes the functions of the ISBD at this location.

5. The central service provider is authorized to provide services to third parties outside the scope of application according to § 2, provided that these parties commit to ensuring at least the cantonal security requirements. The central service provider is authorized to carry out or delegate the corresponding controls.