ISMS: How required protection is derived from process to asset

You classify your information and perform the business impact analysis (BIA) on your business processes. Ariadne ISMS then calculates the required protection of your processes and assets on its own. This lets you justify for every system why it needs a certain level of protection, and you never maintain a value twice.

Three sources, one result

The required protection of an asset is made up of three building blocks. You maintain each of them in exactly one place.

Information

Provides confidentiality, integrity and data protection

C · I · DP

You classify each information item once with its security and privacy classification. The result flows to every process and asset that processes it.

Business impact analysis

Provides availability

Availability

The BIA on a business process produces its availability curve: the highest impact per time period. Availability comes exclusively from the BIA, never from information.

Dependencies

Carry the required protection to the asset

Propagation

With a process → asset or asset → asset dependency, you define which information is processed and how strongly availability is passed on.

The basic rule: the highest value wins

Ariadne ISMS follows the maximum principle. If a process or an asset processes several information items, the highest level counts. This way a system is never rated lower than the most critical information it carries.

Required protection of a business process

• Confidentiality and integrity: the highest value of all linked information.
• Data protection: Personal data, Art. 9 or Art. 10 applies to the process as soon as at least one linked information item has that attribute.
• Availability: comes from the process's BIA.
• Unclassified and archived information is not taken into account.

You see the result in the process sidebar under Required protection and Information privacy.

Required protection of an asset

• Confidentiality and integrity: the highest value of the information you selected on this asset's dependencies.
• Data protection: applies as soon as one of these information items has the attribute.
• Availability: the availability curve of the processes, passed on along the dependency chain.

How the dependency mode controls availability

Chains and multiple processes

• Chains: If an asset depends on another asset, the ISMS passes the required protection on, for example from the CRM to the database server below it. Every Workaround possible dependency along the way shifts the curve by one more period.
• Multiple processes: If several processes use the same asset, the ISMS takes the highest value per period. Central systems such as a file server automatically show up as critical.

A worked example

The example uses the default values. The scale, BIA time periods and intolerance level may be configured differently in your organization.

This is the CRM's availability depending on the dependency mode:

With Optional, the asset shows "No propagated availability impact." under Required protection.

What to keep in mind

• Cannot be edited manually: You cannot overwrite the derived required protection. If a value does not fit, correct the information's classification, the BIA or the dependency.
• Automatic recalculation: When you change classifications, links or dependencies, the ISMS recalculates. On assets, the new value may appear with a short delay.
• Make gaps visible: Unclassified information and processes without a BIA do not contribute any required protection. Work through the open items under Action required on the dashboard so your result is complete.

Related articles

• ISMS: Classify information: confidentiality, integrity and data protection
• ISMS: Perform a business impact analysis and understand the MTPD
• ISMS: Create assets, maintain dependencies and derive required protection
• ISMS: Why you start with business processes and information