ISM Logs

BSI 200-3 covers risk analysis based on IT-Grundschutz. It's needed when the standard Grundschutz measures aren't sufficient — for assets with high security requirements or unusual scenarios. * The BSI 200-3 process; a supplementary risk analysis kicks in only where standard Gru...

Quiz: ISM / Standards & Frameworks I (ISO, BSI) | updated: Jul 30, 2026

Information security stands on three pillars — technology, processes, and people — and it is only as strong as the weakest of them; a firewall means nothing if the process is undefined or an employee clicks the phishing link. * Information security rests on three complementary p...

Quiz: ISM / Standards & Frameworks I (ISO, BSI) | updated: Jul 30, 2026

Vulnerability, Assets, and Profile of Attacker — together they answer who/why, what/how, and where/when an attack happens. * Value at Risk — three factors combine: Vulnerability (where/when), Assets (what/how), Attacker Profile (who/why). * Value at Risk decomposes cyber risk in...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

High-value assets are the systems and processes that produce value or money — e.g. a customer database, web portal, payment process, reconciliation, a SWIFT gateway, the production/operational-technology (OT) process, an ERP or HR system, or logistic planning. The point is to fin...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

Listing concrete, catalogued mitigations — like network segmentation (M1030) or multi-factor authentication (M1032) — turns vague intentions into specific, traceable controls mapped to the threats they counter. Example improvements from the worked exercise include segmenting the...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

BSI 100-4 covers emergency management (business continuity), providing a methodology for establishing and maintaining an organization-wide emergency management system. Key characteristics: Methodology for business continuity management (BCM) Creates a standalone management syste...

Quiz: ISM / Standards & Frameworks I (ISO, BSI) | updated: Jul 30, 2026

Who and why = threat types and their motivations; what and how = the type and technical sophistication of the attack; where and when = the organization's vulnerability measured against a cyber-resilience maturity level. "Who and why" addresses target attractiveness and threat mot...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

A Threat Matrix maps types of adversary (rows) against types of target (columns) and fills each cell with the intent — the kind of harm that actor would pursue against that target. * Threat Matrix — adversary types (rows) × target groups (columns); each cell names the intent, co...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

The gap between where a control is today (current) and where it needs to be (desired) is exactly the work the improvement roadmap must fund — it makes the investment case concrete and prioritizable. For each measure (segmentation, access management, XDR monitoring, incident respo...

Quiz: ISM / Threat & Impact Modelling | updated: Jul 30, 2026

An ISO 27001 certificate based on IT-Grundschutz includes both an ISMS audit and a verification of concrete IT security measures — making it more rigorous than a standard ISO 27001 certification. ISO 27001 on IT-Grundschutz: Covers both the ISMS (management system) and the concr...

Quiz: ISM / Standards & Frameworks I (ISO, BSI) | updated: Jul 30, 2026