Glossary

A

User (End User):

A person who uses IT services in daily work (not the same as a customer).

Example: EU Paying Agency BW = processing offices using specialized procedures.

Application (App/Software):

IT support for processes; combines IT resources for a specific purpose.

Work Instruction:

Detailed description for the repeatable, quality-compliant execution of activities.

Assets:

Valuable target objects of an institution (e.g., information, systems, rooms).

Authentication:

Proof of identity (e.g., password, smart card, biometric feature).

Authenticity:

The property of truly matching the authenticated identity.

Authorization:

Validation/approval of access rights to resources.

Availability Management (ITIL):

Ensuring agreed service availability, including planning, measurement, and improvement.

B

Basic Security Check (BSC):

Interview-based target/actual comparison of IT baseline protection implementation (older BSI 100-x standards).

Module (IT Baseline Protection):

Modular content with short description, threat scenario, recommended measures.

Threat:

Condition/event that may cause harm to C, I, A via vulnerabilities.

User Account (Username/Login):

Identification feature of a user towards an IT system.

Best Practices:

Proven practices.

Biometrics:

IT-supported identification based on physical/behavioral features (e.g., fingerprint, iris).

Bugfix / Hotfix / Patch / Update / Upgrade:

Error correction or functional enhancement.

- Hotfix = urgent patch

- Update = usually minor

- Upgrade = major

Federal Office for Information Security (BSI):

German authority for IT security; publisher of IT Baseline Protection; certification body.

Federal Data Protection Act (BDSG):

German federal law on personal data protection (supplements GDPR, state laws).

Business Impact Analysis (BIA):

Assessment of potential impacts of failures on business processes.

C

Capacity Management (ITIL):

Ensuring sufficient capacity/performance (business, service, component levels).

Change Management (ITIL):

Managing changes to IT operations with minimized risk.

Configuration Item (CI):

An asset or IT component.

Configuration Management (ITIL):

Managing/verifying information about CIs.

CMDB (Configuration Management Database):

Database mapping and linking CIs including lifecycle data.

D

Data Protection:

Protection of personal data (fundamental right; GDPR/BDSG).

Data Security:

Technical goal to protect data of any type from loss/manipulation.

Backup:

Full/incremental/differential; ensures C, I, consistency.

Demilitarized Zone (DMZ):

Network zone between different security levels.

Digital Signature:

Verifies authorship and integrity of data.

E

Effectiveness:

Achieving objectives (regardless of effort).

Efficiency:

Economy (effort-benefit ratio).

Supplementary Security Analysis:

Identifies where risk analyses beyond IT Baseline Protection are needed (higher protection needs, special cases, atypical scenarios).

EU Paying Agency Baden-Württemberg:

Administrative units for EGFL/ELER funds (approval, control, payment, accounting).

F

Specialized Application:

Software for specific requirements/industries.

Specialized Task:

Government tasks for planning/operating the EU Paying Agency.

Operational Responsibility (Specialized):

Data administration, user support, responsibility for specialized applications.

Specialized Procedure:

IT support for administrative services; consists of one or more applications.

Financial Management (ITSM):

Budgeting, cost allocation, and service charging.

Firewall (Security Gateway):

Secure network interconnection, filtering allowed connections.

G

Hazard:

Umbrella term; threat = specific hazard (e.g., defective storage medium).

Threat:

A hazard exploiting a vulnerability and causing harm.

Core Value/Security Objective:

Confidentiality, Integrity, Availability.

GSTOOL:

Former BSI software for security concepts (discontinued, support until 2016).

H

(—)

I

Incident Management (ITIL):

Minimizing disruptions, restoring service; prioritization by impact/urgency.

Information Security:

Protecting analog/digital information; absence of unacceptable risks.

CISO / ISB:

Chief Information Security Officer / Information Security Officer; develops/facilitates policies; manages ISMS.

Information Security Event:

An event that may impair security.

Information Security Incident:

(Series of) events with risks for business operations/information security.

ISMS (Information Security Management System):

Rules, processes, measures to manage information security (continuous, PDCA).

IT (Information Technology):

Means for processing/transmitting information.

Scope (Information Network):

All objects (infrastructure, organizational, personnel, technical) in an application area.

Infrastructure (Baseline Protection):

Buildings, rooms, power, climate, cabling (without IT systems).

Institutions:

Companies, authorities, other organizations.

Integrity:

Absence of unauthorized modifications to systems/data.

Internal Audits:

Regular ISMS effectiveness/conformity checks; basis for improvements.

Internal Control System (ICS):

Principles/measures to ensure effectiveness, compliance, and legality.

ISO 27000 Family (ISO27k):

International information security standards.

- ISO 27001: ISMS requirements (certifiable).

- ISO 27002: Implementation guide for controls (non-certifiable).

Partial IS Revision:

Review of specific processes using baseline modules.

ITIL (IT Infrastructure Library):

Best practices for IT service management (ITSM).

IT Security:

Protection of electronically processed information (subset of InfoSec).

K

Critical Infrastructure (KRITIS):

Facilities vital for supply/safety.

Accumulation Effect:

Higher protection needs from cumulative damages/dependencies.

Customer:

Buyer/contract partner of an IT service provider; SLA addressee.

L

Information Security Policy:

Strategic document defining goals, means, structures, and desired security level.

M

Maximum Principle:

Highest potential damage determines protection needs.

Modeling (Baseline Protection):

Assigning modules to structure elements; basis for target/actual comparison.

N

Traceability:

Complete recording of actions (who/what/when).

Evidence Documents:

Process results (e.g., plans, logs, audits, reviews).

Network Diagram:

Clean overview of elements and connections.

Non-repudiation:

Data origin/receipt cannot be denied.

P

Penetration Test:

Non-destructive test of security measures.

Prioritization:

Resource control by impact/urgency (incident mgmt).

Problem Management (ITIL):

Eliminating/preventing incident root causes.

Proxy:

Intermediary node for data forwarding/filtering.

Process:

Structured activities transforming inputs into outputs.

R

Release Management (ITIL):

Planned, disruption-minimized rollouts of approved components.

Residual Risk:

Remaining risk after treatment.

Audit/Revision:

Independent review of suitability/compliance.

Risk:

Combination of threat + vulnerability; evaluated by probability × impact.

Risk Acceptance:

Deliberate decision to accept risk (temporary/permanent).

Risk Analysis/Assessment/Evaluation/Management:

Identification, analysis, evaluation, treatment, monitoring of risks.

S

Malware (Virus, Worm, Trojan, Rootkit, Spyware):

Software with harmful functions.

Protection Needs/Definition/Assessment:

Classification as normal/high/very high per object; inheritance rules.

Security Objectives:

Confidentiality, Integrity, Availability.

Vulnerability:

Weakness enabling exploitation by threats.

Server:

System providing services to clients.

SLA (Service Level Agreement):

Agreement on service objectives/responsibilities.

Service Level Management (ITIL):

Negotiating/monitoring SLAs; reviews/improvements.

Security Gateway (Firewall):

Network interconnection per policy.

Security Concept:

Plans/documents to achieve security objectives.

Security Measure:

Organizational, personnel, technical, or infrastructural action.

Security Policy:

Official document with security objectives and general measures.

Single Point of Failure (SPOF):

Component whose failure disrupts the entire system.

Structural Analysis:

Recording objects/relationships in the scope.

Structure Elements:

Applications, IT systems, networks, rooms, buildings, connections.

Support (Helpdesk/IT Support):

1st/2nd/3rd level support.

Technical Operation:

Facilities, infrastructure, hardware, system software, databases.

U

Underpinning Contracts (UC):

Contracts with external providers supporting services.

V

Availability:

Provision of information/services as required.

Encryption:

Transforming plaintext into ciphertext via keys.

Distribution Effect:

Reduced inherited protection needs by spreading across systems.

Confidentiality:

Protection against unauthorized access.

VLAN (Virtual LANs):

Logical network segmentation.

VPN (Virtual Private Network):

Logically separated, authenticated, encrypted network.

Directive Documents:

Binding rules with mandatory implementation.

W–Z

Assets:

Anything valuable to an institution (assets, knowledge, health, objects).

Asset Owner:

Responsible for assessing, protecting, and securing an asset.

Asset Register:

Inventory of relevant asset information supporting security concepts.

WLAN (Wi-Fi):

Wireless networks (IEEE 802.11).

Certification Scope:

Subset of the ISMS scope under certification.

Target Object:

Element within the scope assigned modules.

Access/Entry/Use:

System use / data knowledge / physical entry.