Ordinance on IT Security (IT Security Ordinance, ISV) (Informatiksicherheitsverordnung, ISV) - Principle (ISV)

1. This Regulation aims to ensure an orderly, effective, and economical information technology and information security.

2. The Regulation specifies

a) the procedures, responsibilities, and accountabilities for ensuring the security of data and information processed with information technology systems and applications

b) the fundamental security requirements that must be adhered to when processing data or information with information technology systems and applications

1. This regulation applies to

a) the cantonal administration, judicial authorities, and public law institutions

b) the municipalities and all public law entities within the Canton of Schaffhausen, insofar as they jointly operate information technology systems and applications with the cantonal administration, exchange data or information, or have their own applications operated by the KSD

c) departments or administrative units that enforce federal law or perform federal tasks and use their own or third-party information technology systems or applications, insofar as there are no security requirements imposed by the federal government

1. The following terms mean

a) IT Systems: Devices and installations, along with the associated infrastructure and operational software, utilized for the electronic processing or electronic exchange of data or information

b) IT Applications: Programs that enable the use of IT systems for the performance or support of specific tasks, including the data processed therein

c) Information: Information is the result of specific queries obtained from factual, financial, or personal data

d) Data Collection Holder: Any organizational unit of the public administration of the canton, municipalities, or other public legal entities within the Canton of Schaffhausen, which is responsible for the processing of data or information based on a legal foundation

e) Operator of Central Databases: Generally the cantonal IT service provider KSD, in exceptional cases third-party operators or the respective data collection holder, insofar as the database is operated decentrally

2. If it is not clearly defined or determinable due to a legal task, who the holder of a data collection or the operator of a database is, it must be agreed upon in writing among all involved parties, and a responsible data collection holder must be designated.

1. The holder of a data collection and the operator of a central database are obliged, within their respective areas of responsibility, to secure IT systems, applications, data, or information against loss and undesirable influences, to protect them from unauthorized access and unauthorized editing, to ensure the necessary emergency precautions in this regard, and to jointly enforce the principles of this regulation.

2. Unless otherwise provided by legislation, recognized international and national standards for IT security and information management apply to the proper handling and security of IT systems, applications, data, or information.

3. The KSD

a) manages the basic infrastructures

b) supports all organizational units subjected to this regulation in the establishment and operation of secure IT as well as in the implementation and control of security measures

c) monitors compliance with the technical security requirements

d) serves as the point of contact for all organizational units subjected to this regulation regarding IT security matters

4. The holder of a data collection and the operator of a central database are, within their field of responsibility, accountable for the IT systems, applications, data, or information used, especially for

a) determining the protection objectives

b) classification according to the protection objectives

c) creating an action plan to achieve the protection objectives and implementing security requirements

d) controlling the IT operation and IT security within their area of responsibility

5. The IT Security Officer (ISO) of the KSD is responsible for the establishment, implementation, execution, and adaptation of the entire security principles for the IT and telecommunications operations of the KSD, as the central IT service provider and towards all organizational units subjected to this regulation.

6. The KSD specialist committee appoints a Security Board comprising at least three persons, of which at least two are specialists familiar and experienced with IT security issues. This board advises the ISO, acts as a supervisory body over the activities of the ISO, and serves as the escalation point according to § 16 para. 1 of this regulation.

1. The following protection objectives apply to information systems, applications, and information

a) Availability: Information systems, applications, data, or information are accessible and usable.

b) Confidentiality: Data or information is accessible only to authorized individuals.

c) Integrity: Information systems, applications, data, or information are protected from unauthorized alterations. All data and information are complete and correct.

d) Traceability: An event chain can be retrospectively traced.

e) Evidentiary and Audit-proof: pursuant to § 12 para. 3 of this regulation.

2. The owner of the data collection and the operator of a database must determine the protection needs of the data and information based on these protection objectives.

1. The information systems, applications, as well as data and information must be classified by all organizational units subject to this regulation according to the following criteria

a) Availability: Downtime of 3 days or more (low level); Downtime of 1-3 days (medium level); Downtime of up to one day (high level)

b) Confidentiality: Level P (public), Level N (non-classified internal data), Level C (confidential), Level S (particularly sensitive)

c) Integrity: Extent of impairment in data usage lasts several years (very high level); up to a maximum of one year (high level); has a significant impact on business results, but does not last more than a year (medium level)

d) Traceability: no traceability; anonymized traceability; personal traceability

e) Evidence suitability and audit security: via electronic signing and retention periods

2. The KSD issues instructions concerning the classification of data and information.

3. The owners of a data collection and the operators of a central database are authorized to refine the classification within their area of responsibility and issue additional internal instructions for their own organizational unit.

1. The holders of a data collection and the operators of a central database shall create a plan of organizational and technical measures which ensures the achievement of the identified protection objectives. The measures shall be directed according to the requirements for operation and security (§ 9 et seq.) as well as according to the further guidelines of the KSD (§ 14 and § 17). In doing so, the principle of proportionality, the state of the art, and the available resources are to be taken into account.

2. The plan of measures shall contain the following details for all information systems, applications, data, or information in use

a) Protection objectives and classification

b) Content

c) Costs

d) Responsibilities

e) Implementation steps and deadlines

f) Residual risk

g) Documentation

1. The holders of a data collection and the operators of a central database shall inform their employees about the security measures that must be observed.

2. They shall ensure regular training of their employees.

1. To prevent loss, damage, and misuse of information systems, applications, data, or information, and to prevent an interruption of business activities, the buildings, rooms, and equipment must be protected against security threats.

2. The KSD ensures that violations of the security principles according to this regulation can be traced and reproduced in a provable manner with reasonable effort.

1. Access to information systems, applications, data, or information is regulated through membership in authorization groups and/or roles. Users are included in the authorization groups and/or roles required for the performance of their duties. They must authenticate themselves accordingly on information systems.

2. The owner of a data collection is responsible and accountable for the assignment of access rights and their ongoing updates. Information systems must be capable of authenticating users according to their permissions.

3. Authentication methods must be continually adapted to the risk situation and the state of the art.

1. Access Rights of Employees, Contractors, or Third-Party Users to Information Systems, Applications, Data, or Information must be immediately revoked by the owner of a data collection when their employment, contract, or corresponding use has ended, or if misuse or a violation of the security principles according to this regulation has been identified.

2. If employment, contract, or use changes, the access rights must be promptly adjusted by the owner of a data collection.

1. For the data backup on the central IT systems of the cantonal administration, the KSD is responsible. The backup includes

a) the user identifications and their access rights (objects)

b) the specialized applications and their data

c) the data storage

d) the connection data of internet and email traffic

e) all data and program areas necessary for the reconstruction of the IT systems

2. The data backup may also include log files.

3. The backed-up data is stored separately and securely and can be used to reconstruct lost data and evaluated within the framework of the established backup concepts. Their probative value, legal compliance, and audit-proof storage as well as their digital long-term archiving remain within the responsibility of the owner of a data collection.

4. For the data backup on local or decentralized IT systems, the owner of a data collection is personally responsible.

1. The KSD may further define or specify the necessary requirements for operations and security within the framework of guidelines or instructions, particularly concerning

a) the standardization and organization of infrastructures

b) access protection and security evaluations

c) electronic data communication

d) data exchange

e) data backup and storage

f) ensuring business operations

g) Internet and email usage

h) protection against threats such as malware, computer viruses, social engineering, phishing, etc.

i) mobile storage media and end devices

j) requirements for the use and security measures of social media

k) the handling by employees of IT both in the workplace and outside of office premises

l) management upon termination or alteration of the employment relationship

m) new technologies and infrastructures

2. The KSD may consult and listen to the experts of data collection owners for drafting guidelines or instructions.

1. Any irregularities, unexplained system behavior, loss or alteration of IT systems, applications, data or information, suspicion of misuse of one's user identification, or other security-relevant incidents must be promptly reported to the IT Security Officer of the KSD (ISB). The ISB will inform the Data Protection Officer.

2. The owner of a data collection and the operator of a central database shall establish procedures that enable the rapid, effective, and systematic detection and response to security-relevant incidents. The KSD assists them in this matter.

1. The holders of a data collection and the operators of a central database shall regularly, but at least once a year, review the protection objectives and classification of the IT systems, applications, data, and information under their jurisdiction, the compliance and adequacy of security measures, as well as access rights.

2. The holder of a data collection and the operator of a central database shall maintain the necessary documentation in accordance with these regulations up to date and inform the Cantonal Security Department (KSD) appropriately and in a timely manner.

3. If tasks, organization, or the IT systems and applications used, or the data and information processed with them change, the holder of a data collection and the operator of a central database shall make the necessary adjustments (see also § 11).

4. The holder of a data collection and the operator of a central database may additionally have the protection objectives, classification, and the measures taken reviewed by a qualified independent external body in coordination with the KSD. The financial control of the Canton and City of Schaffhausen, the KSD, and the Cantonal Data Protection Officer may inspect the reports.

1. If the holder of a data collection or the operator of a central database does not agree with the requirements of the KSD, the Security Board of the KSD (§ 4 para. 6) shall be called upon. The Security Board shall attempt to find an amicable solution, involving the calling party.

2. If no amicable solution can be found within three months of the registration of the discrepancy with the Security Board, the government council shall make the decision. The data protection officer may be heard in advance.

1. The KSD issues and publishes all necessary instructions, guidelines, or regulations regarding the use of IT systems, applications, data, and information to ensure secure and economical utilization and operation of IT, and to specify protection objectives and security requirements.

2. The KSD supports the owners of a data collection and the operators of a central database in all matters related to the implementation of this regulation.

1. The holders of a data collection and the operator of a central database are required to establish the protection objectives (§ 5), classification (§ 6), and action plan (§ 7) for all IT systems, applications, data, and information in coordination with the CSS within two years of this regulation coming into force.

1. The Regulation on the Protection and Security of Data at "KSD Canton and City of Schaffhausen Data Processing" (Data Protection Regulation) of April 22, 1980, is hereby repealed.

1. This regulation shall come into force on January 1, 2015.

2. It is to be published in the official gazette and included in the cantonal law collection.