EMZETT.Protection requirement assessment: Rating confidentiality, integrity, availability
In short: In a protection requirement assessment, each data set or system is rated for how high the protection must be regarding confidentiality, integrity and availability.
In more detail: Not everything must be protected equally strongly. The protection requirement assessment helps weigh effort and benefit. It comes from BSI IT-Grundschutz and appears often in IT projects and IHK exams.
In Depth
The three protection goals
- Confidentiality: only authorised people see the data.
- Integrity: data is correct and unchanged.
- Availability: data and systems are usable when needed. Often authenticity, non-repudiation and privacy goals are added.
Protection requirement categories
Usually three levels: normal, high, very high. The measure is the possible damage if the protection goal is violated: breach of laws, harm to people, financial consequences, loss of reputation, failure of tasks. Examples:
- Public website: confidentiality normal, integrity high (no forged content), availability medium.
- Personnel files: confidentiality very high.
- Online shop: availability high because outage costs revenue.
Procedure
- Record objects (systems, applications, data, rooms).
- For each protection goal estimate damage scenario-based.
- Set and justify the category.
- Mind inheritance: dependent systems often take over the highest protection requirement (“maximum principle”).
- Derive measures (encryption, access rights, backup, redundancy) and document them. For personal data the data protection impact assessment complements the view.
Practice and documentation
Use a table: object | confidentiality | integrity | availability | justification | measure. Keep the justification short and concrete. This shows in the project documentation that you consider security systematically rather than generally.
See also: Protection goals of information security, ISO 27001 and BSI Grundschutz, Risk analysis and SWOT, Threat modeling