To keep risk management manageable and efficient, the BIO chooses to develop risk management based on three basic security levels (BBN).
BBN1: at this level, the emphasis is on "what should be minimally expected?
BBN2: at this level, the focus is on protecting the most common categories of information according to the principle of "does the measure fall under good housekeeping; does this security demonstrate trustworthy government?
BBN3: this (exceptional) level applies to classified information Departmentally Confidential or similarly confidential in other layers of government, requiring resistance to state actors or similar threats
Now there are times when a process or system needs a higher level of protection than BBN2 but resistance to state actors is not necessarily necessary. For those situations, the BBN2+ level applies.
The IBD has worked with municipalities to develop a set of measures appropriate to adequately protect information above BBN2. This set can be used instead of an in-depth risk analysis. There is an approach based on one's own risk assessment and no obligation. The set can be freely used to implement (in whole or in part). The set can also be used in agreements within chains and with suppliers.
View: measure set BBN2+
