The extent of the information security policies available and if they're adapted to the organization's goal is the main concern.

It also includes listing out responsibilities between external IT service providers and own organization, as well as asset management - specifically, how assets are discovered, secured, and assigned. 

Information Security Risk Management needs to have a person responsible for the assessment and risk assessments need to be carried out at regular intervals in response to events.

The organization must identify sensitive work areas and define job-specific requirements for employees, ensuring these requirements are met.

It is essential to verify the identities of potential employees by checking their identity documents.
A non-disclosure obligation and adherence to information security policies must be enforced.

Employees should receive training to increase their awareness of security practices.

For teleworking, the organization needs to establish and fulfill requirements that address secure handling of information, appropriate behavior in both private and public settings, and protective measures against theft in public areas.

Access to the organization’s network should be secured through a connection like a VPN, along with strong authentication measures in place.

A security zone concept must be established, incorporating protective measures aligned with the handling of information assets. This concept should consider the physical conditions of premises, buildings, and spaces, including delivery and shipping areas. The defined protective measures need to be implemented, and all individuals involved should be aware of the code of conduct for these security zones.

Requirements for handling supporting assets, such as transport, storage, repair, loss, return, and disposal, must be clearly defined and fulfilled. Additionally, requirements for mobile IT devices and mobile data storage devices should also be established and met, focusing on aspects like encryption, access protection (such as PINs or passwords), and proper marking, especially for situations involving customer interactions.

Requirements for managing identification means throughout their lifecycle must be established, covering creation, handover, return, destruction, validity periods, traceability, and loss handling.

User authentication procedures should be based on a risk assessment that considers potential attack scenarios. State-of-the-art methods must be implemented.

User account management should include creating, changing, and deleting unique and personalized accounts, with collective accounts regulated for traceability. Accounts must be disabled immediately upon employee departure, and regular reviews should be conducted. Login information should be securely provided, with a policy in place to prevent disclosure, unencrypted storage, and ensure quality requirements for authentication information.

Access rights management must include established procedures for application, verification, and approval, following the principle of least privilege. Access rights should be revoked when no longer needed, and regular reviews should be conducted for all user accounts.

All cryptographic procedures used must meet industry standards for security, as legally feasible. Network services for information transfer should be identified, documented, and governed by defined policies that ensure protection against unauthorized access.

Information security requirements for organizational changes, business processes, and IT systems must be determined and applied. IT systems should undergo risk assessments to justify their separation into development, testing, and operational environments, with segmentation implemented accordingly.

Requirements for malware protection must be established, with both technical and organizational measures in place. Information security requirements for event log handling should be identified and fulfilled, ensuring logging of activities by system administrators and users is assessed and monitored, especially when using external IT services.

Technical vulnerabilities in IT systems must be identified, assessed, and addressed based on gathered information. Requirements for auditing IT systems should be determined, with audits coordinated with relevant stakeholders and results reported to management.

Network management and control requirements must be fulfilled, including network segmentation. Critical IT services should be identified, with continuity and recovery responsibilities known to stakeholders. Backup and recovery concepts for relevant IT systems must be established, ensuring data confidentiality, integrity, and availability.

Contractors and cooperation partners must undergo a risk assessment regarding information security, ensuring an appropriate level of security through contractual agreements. Any relevant agreements with clients should be communicated to contractors and cooperation partners, and compliance with these agreements must be verified.

Non-disclosure requirements should be established and fulfilled, with all individuals involved in sharing protected information aware of the requirements and procedures for non-disclosure agreements. Valid agreements must be in place before forwarding sensitive information, and the related requirements and procedures should be reviewed regularly.

Legal, regulatory, and contractual provisions relevant to information security must be regularly identified. Policies for compliance with these provisions should be defined, implemented, and communicated to responsible individuals.

Information security requirements concerning the processing of personally identifiable data must be established, with regulations for compliance known to entrusted personnel. Additionally, processes and procedures for protecting personally identifiable data should be integrated into the information security management system.