Cybersecurity für Kritische Infrastrukturen (KRITIS)

(*)
_{^{There is no provision in ISO 27001 or in any law that states in a general and binding manner: “Anyone who complies with ISO 27001 automatically complies with the state of the art.”}}

_{^{Why not?}}

• _{^{ISO 27001 is an international management standard for information security management systems (ISMS).}}
• _{^{It defines processes and controls, but it is technology-neutral and does not specify which specific security measures are “state of the art.”}}

_{^{Where does the reference to ISO 27001 ↔ “state of the art” come from?}}

• _{^{Authorities such as the BSI or data protection supervisory authorities often say:
  The introduction of an ISMS in accordance with ISO 27001 supports compliance with the state of the art because the standard systematically records security risks and selects appropriate measures.}}
• _{^{In practice, ISO 27001 is often accepted as proof that an organization works in a state-of-the-art manner in terms of organization and processes.}}
• _{^{ISO 27001 alone = a good foundation, but does not automatically fulfill “state of the art.”}}
• _{^{Combination of ISO 27001 + current technical security standards = strong evidence.}}