How does Komplexitätsreduktion (complexity reduction) work in the structure analysis, and what is the one thing you must NOT group together?

Similar components are bundled into groups treated as single objects — but never mix components with substantially different protection needs.

To keep the analysis manageable, similar components are grouped. Grouping criteria — systems with:

• the same type
• the same or nearly the same configuration
• the same or similar network connection
• the same administrative and infrastructural conditions
• the same tasks
• the same protection needs

The resulting groups are treated as single objects from then on (one "client group" instead of 500 individual clients).

The cardinal rule: never group components with too different protection needs. Examples:

• Management-board clients do not belong in the "normal clients" group
• Same for clients of development, HR, accounting, and IT administration — they all have elevated protection needs

Otherwise the group's assessed protection level would either over-protect the many or (worse) under-protect the sensitive few.